API Access

Authentication

API access guide

This page is the authority for public API credential mechanics. Use an issued API key as your bearer token for public API calls, from server-side code only. An enabled account manages its app and key lifecycle in Developer Portal; this reference does not promise that access can be obtained through a self-service flow.

No issued key

Review the access boundary

Public contract documentation does not establish account eligibility or issue credentials.

Review Get API Key

Credential mechanics

Review a request shape

Apply the credential pattern only after the relevant access conditions are available.

Read First API Call

Compatibility routes

Use supported automation only

Direct app, key, and credential-management routes are compatibility material for supported workflows.

View direct route notes

Bearer token pattern

Header

Authorization: Bearer YOUR_API_KEY

Content-Type

application/json

Next public API

POST /v1/offers/query

Bearer request pattern

curl

curl -X POST https://api.aon.pro/v1/offers/query \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "AON-Protocol-Version: 1.0" \
  -d '{ "intent": { "content": [{ "type": "input_text", "text": "travel offers" }], "provenance": "user_expressed" }, "context": { "platform": { "name": "api-client", "channel": "api" } } }'

Recommended setup

If this is your first integration, start with Quick Start to understand the versioned public contract and request shape.
Use Developer Portal to manage the app and key lifecycle for an enabled account.
Use the issued API key as a bearer token from your server, not from client-side code.
Keep registration, login, app creation, and key rotation in Portal UI unless you have a supported automation use case.
After access conditions are ready, continue to First API Call for the HTTP request shape.

Compatibility reference

These authentication routes exist in the OpenAPI source for platform and compatibility flows. They are not the default starting point for a new public integration.

POST /v1/auth/send-code

Send verification code

Send a verification code to the provided email address.

POST /v1/auth/register

POST /v1/auth/login

Authenticate a user and issue access and refresh tokens.

GET /v1/auth/me

Get current user profile

Return the currently authenticated user's profile and identity metadata.

Next step

Review the First API Call request shape after the relevant access conditions are in place.