# Authentication

Every call carries your credential as a Bearer token in the `Authorization` header.

```bash
curl "https://api.avantetravel.com/api/v2/transfers/products" \
  -H "Authorization: Bearer YOUR_CREDENTIAL"
```

In v1 the call is the same, with the v1 path, for example `POST /api/v1/transfer/getCatalog`.

The credential is an opaque string that identifies your company. It is not a JWT and you cannot read anything from it. It does not expire on its own. The same credential works in v1 and in v2.

## Get a credential

Credentials are issued by Avante. Ask your account manager for a sandbox credential first and a production credential when your integration is ready. See [Support](/developers/guides/support).

## Send it only in the header

Do not send the credential in the body or in the query string. Query strings end up in proxy logs and browser history.

The older `id_company` field is still accepted on some v1 endpoints of existing integrations, and it may stop being accepted. Do not use it in a new integration. Transfers and Disney reject it with `401`. v2 never takes it: a request with `id_company` in the body or in the query answers `400 VALIDATION_ERROR` with the issue code `NOT_ACCEPTED`.

In v1, if you send both the header and `id_company`, the two values must be the same. If they differ, the API answers `403`:

```json
{
  "error": "Credential mismatch",
  "message": "The 'id_company' in the request does not match the Authorization bearer token.",
  "code": 403,
  "request_id": "3f8a9b2c4d5e6f7a8b9c0d1e2f3a4b5c"
}
```

## Authentication errors

These are the v1 answers. In v2 the body is the [v2 error envelope](/developers/guides/v2-errors), and the code says what happened: `401 AUTHENTICATION_REQUIRED` (no header), `403 FORBIDDEN` (a credential we do not recognise, or a credential with no access to the product: check the token first), `403 CATALOG_RESTRICTED` and `403 IP_NOT_ALLOWED`. v2 has no `Credential mismatch`.

| HTTP | `error` | Meaning | What to do |
|---|---|---|---|
| 401 | `Authentication required` | The header is missing, or the endpoint does not accept `id_company`. Transfers and Disney always answer this way without the header. | Send `Authorization: Bearer <credential>`. |
| 403 | `Credential mismatch` | The header and `id_company` carry different values. | Stop sending `id_company`. |
| 403 | `Access forbidden` | The credential does not exist, or your account does not have this product enabled. | Check the credential. Then ask your account manager to enable the product. |
| 403 | `IP not allowed` | Your credential is restricted to a list of IP addresses and the request came from another one. | Ask your account manager to register your outbound IP. |

Two details about the shape of these responses:

- Hotels and Transfers answer `Access forbidden` with the full error envelope. On Universal and Disney, the same `403` body has only a `message` field: `{"message": "Access forbidden: You do not have permission to perform this request."}`. Detect it by the HTTP status.
- Some products may answer a missing credential with `400` or `403` instead of `401`, depending on the endpoint. Treat any of the three as an authentication problem and check the header.

## Permissions

The credential is enabled per product: Transfers, Hotels, Universal and Disney. Each one is independent. You can have Universal without Disney. A call to a product you do not have returns `403`. In v2, tickets are enabled per brand (Universal, Disney): the catalog lists only what your credential can sell, and a booking of a product you do not have answers `403 FORBIDDEN`. Reading, cancelling and the voucher of a booking follow your company, not the product.

A credential can also be restricted to a list of IP addresses. If you want that, ask your account manager. A credential with no addresses registered accepts every IP.

## Keep the credential safe

- Store it in an environment variable or a secret manager.
- Call the API from your servers. Do not put the credential in browser code or in a mobile app.
- Do not commit it to a repository.
- If it leaks, tell your account manager right away and ask for a new one.

## Next

- [Conventions](/developers/guides/conventions) covers formats, rate limits and idempotency.
- [Errors](/developers/guides/errors) lists every error you can receive.