API keys - Flynet Docs

API keys authenticate your app, not a member. Use them on restaurant and location Discovery routes. They are the only credential those routes accept.

Format

API keys are 40-character strings with a prefix that indicates how they were issued:

fly_live_<40 chars>    Production credentials
fly_test_<40 chars>    Staging / dev credentials

fly_live_ keys are production keys; fly_test_ keys are staging/dev keys. The environment binding is server-side: your key is scoped to the DeveloperApp and environment it was minted under. Use the key you received in your onboarding email for the environment you were provisioned for. Send the key in X-API-Key:

curl -H "X-API-Key: $API_KEY" \
  https://api.staging.blackbird.xyz/flynet/v1/restaurants

What API keys cover

Route	API key	OAuth bearer
`/restaurants` and `/restaurants/{id}`	Required	Returns 401 (empty body)
`/restaurants/{id}/locations`	Required	Returns 401 (empty body)
`/locations` and `/locations/{id}`	Required	Returns 401 (empty body)
`/locations/{id}/open_hours`	Required	Returns 401 (empty body)
`/check_ins` (venue feed) and `/check_ins/{id}`	Required (key minted with `read:checkins`)	Returns 401 (empty body)
`/app`	Required (`read:app`)	Returns 401 (empty body)
`/balance`	Required (`read:balance`)	Returns 401 (empty body)
`/issue_reward`	Required (`write:rewards`)	Returns 401 (empty body)
`/challenges`	Required (`read:restaurant_challenges`)	Returns 401 (empty body)
`/specials`	Required (`read:restaurant_specials`)	Returns 401 (empty body)
`/users/me/`, `/payment_intents/`	Returns 401 (empty body)	Required

From the kitchen - Discovery routes use the API key. Member-acting routes use OAuth. The two do not substitute for each other.

Chef’s warning - API keys are server-side only. Every call that carries an API key must originate from your backend, never from a browser, mobile client, or any code shipped to users. Don’t embed them in client-side bundles, public repos, screenshots, or environment variables checked into source. A key visible in a client is a key you have to assume is compromised. Treat them as you would a password, and route Discovery calls through your own backend rather than calling the API directly from the client.

If a key leaks

Contact Blackbird support to revoke and issue a new key. Old keys stop working immediately on revocation.

Mixing environments

Don’t reuse a key across environments. Your fly_test_ staging key authenticates against the staging API; your fly_live_ production key authenticates against the production API. They’re issued separately and aren’t substitutes for each other.

​Format

​Header

​What API keys cover

​If a key leaks

​Mixing environments

Format

Header

What API keys cover

If a key leaks

Mixing environments