Get started

Authentication

Every request carries an API key. There are no sessions and no tokens to refresh.

API keys

Create keys in your dashboard under API keys. A key looks like wc_live_ or wc_test_ followed by 32 characters. We store only a hash of it: the full key is shown once, when you create it, so copy it then. You can have several keys (one per server or environment) and revoke any of them at any time.

Test and live

	Test key (wc_test_…)	Live key (wc_live_…)
Works	Immediately, even before approval	After we approve your business
Payments	A mock: no money moves	Real Paystack payments
Cars	Never blocks a real car; never blocked by one	Real bookings on real cars
Money	Nothing is ever recorded in your earnings	Commissions and payouts
Events	Sandbox events (livemode: false)	Live events (livemode: true)
Sandbox simulators	Yes	No

The key decides the mode: there is no switch and no separate address. Use the same base URL for both.

Sending the key

Put it in the Authorization header as a bearer token on every request.

curl "https://engine-production-0004.up.railway.app/api/v1/me" \
  -H "Authorization: Bearer wc_test_YOUR_KEY"

A missing, malformed or revoked key gets 401 unauthorized. A key that is valid but not allowed to do something (a live key before approval, or a fleet endpoint on a marketplace plan) gets 403 forbidden.

Keeping keys safe

Call the API from your server. Never put a key in a web page, a mobile app, a public repository or a support ticket.
Keep keys in environment variables or a secrets manager, one per environment.
If a key may have leaked, create a new one, deploy it, then revoke the old one. A revoked key stops working immediately.
Use test keys in development and staging. Only production gets a live key.

Browsers are not allowed

The API is for servers. Calling it from a browser would expose your key, so cross-origin browser calls are not supported. Build a small endpoint on your own server and call us from there.

What a key can see

A key sees your own bookings, orders, events, money and fleet, and the shared catalogue of cars you are allowed to sell: owners’ cars for a marketplace plan, your own cars for a fleet plan, or both. A business with several keys sees everything any of its keys made, so you can use a separate key per application. You can never see another business’s data, and you never see an owner’s or our share of a booking: only your own commission.

GET /me tells you what this key may do

{ "data": { "business": { "name": "Alpha Rentals", "plan": "both", "status": "approved" },
  "capabilities": { "sellOwnersCars": true, "ownFleet": true, "liveMode": true } } }

Approval

Anyone can sign up and use test keys. Before live keys work, our team reviews your business: you are told by email, and capabilities.liveMode in GET /me turns true. A suspended business loses access to everything.