API Access

Authentication

API access guide

This page is the authority for identity on the public API. Offer Query and MCP identify your integration by its placement id, sent in the X-AON-Placement-Id header. Without a placement id, Offer Query and MCP search run in anonymous mode (no attribution or earnings); MCP write tools require the placement header and need no API key. A Bearer key does not set the placement. Reporting, OfferInfo, Offer Instance and account routes use an issued API key as a bearer token, from server-side code only. An enabled account manages its applications and placements in Developer Portal; this reference does not promise that access can be obtained through a self-service flow.

Placement identity

Get your placement id

Every Offer Query and MCP call is identified by the placement id of your application.

Get your Placement ID

Request shape

Send your first request

Send the placement id with a bounded v1.0 Offer Query.

Read First API Call

Compatibility routes

Use supported automation only

Direct app, key, and credential-management routes are compatibility material for supported workflows.

View direct route notes

Placement identity

Header

X-AON-Placement-Id: plc_…

Content-Type

application/json

Routes

POST /v1/offers/query · /v1/mcp

Traffic is attributed to the application that owns the placement. A placement id is not a secret, so you can call from a browser, web view, or app.

Placement identity request

curl

curl -X POST https://api.aon.pro/v1/offers/query \
  -H "X-AON-Placement-Id: plc_A1b2C3d4E5f6G7h8" \
  -H "Content-Type: application/json" \
  -H "AON-Protocol-Version: 1.0" \
  -d '{ "intent": { "content": [{ "type": "input_text", "text": "travel offers" }], "provenance": "user_expressed" }, "context": { "platform": { "name": "api-client", "channel": "api" } } }'

Bearer token (Reporting API)

Header

Authorization: Bearer YOUR_API_KEY

Content-Type

application/json

Used by

Reporting API

Reporting API bearer request

curl

curl -X POST https://api.aon.pro/v2/developer/reports/offers/batch \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "items": [{ "placement_id": "plc_A1b2C3d4E5f6G7h8" }], "from": "2026-08-01T00:00:00Z", "to": "2026-08-10T00:00:00Z" }'

Recommended setup

If this is your first integration, start with Quick Start to understand the versioned public contract and request shape.
Copy the placement id from your application's Placements page in Developer Portal.
Send the placement id on every Offer Query and MCP call (no placement means anonymous mode, no earnings).
For the Reporting API, OfferInfo API and Offer Instance API, send the application-owned Live API Key as a bearer token from your server, not from client-side code.
Keep registration, login, app creation, and key rotation in Portal UI unless you have a supported automation use case.

Compatibility reference

These authentication routes exist in the OpenAPI source for platform and compatibility flows. They are not the default starting point for a new public integration.

POST /v1/auth/send-code

Send verification code

Send a verification code to the provided email address.

POST /v1/auth/register

POST /v1/auth/login

Authenticate a user and issue access and refresh tokens.

GET /v1/auth/me

Get current user profile

Return the currently authenticated user's profile and identity metadata.

Next step

Review the First API Call request shape with your placement id.