> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flynet.org/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Server-to-server credential for restaurant and location discovery routes.

API keys authenticate your **app**, not a member. Use them on
restaurant and location Discovery routes. They are the only
credential those routes accept.

## Format

API keys are 40-character strings with a prefix that indicates how
they were issued:

```text theme={null}
fly_live_<40 chars>    Production credentials
fly_test_<40 chars>    Staging / dev credentials
```

`fly_live_` keys are production keys; `fly_test_` keys are staging/dev
keys. The **environment binding is server-side**: your key is scoped to
the DeveloperApp and environment it was minted under. Use the key you
received in your onboarding email for the environment you were
provisioned for.

## Header

Send the key in `X-API-Key`:

```bash theme={null}
curl -H "X-API-Key: $API_KEY" \
  https://api.staging.blackbird.xyz/flynet/v1/restaurants
```

## What API keys cover

| Route                                           | API key                                    | OAuth bearer             |
| ----------------------------------------------- | ------------------------------------------ | ------------------------ |
| `/restaurants` and `/restaurants/{id}`          | Required                                   | Returns 401 (empty body) |
| `/restaurants/{id}/locations`                   | Required                                   | Returns 401 (empty body) |
| `/locations` and `/locations/{id}`              | Required                                   | Returns 401 (empty body) |
| `/locations/{id}/open_hours`                    | Required                                   | Returns 401 (empty body) |
| `/check_ins` (venue feed) and `/check_ins/{id}` | Required (key minted with `read:checkins`) | Returns 401 (empty body) |
| `/app`                                          | Required (`read:app`)                      | Returns 401 (empty body) |
| `/balance`                                      | Required (`read:balance`)                  | Returns 401 (empty body) |
| `/issue_reward`                                 | Required (`write:rewards`)                 | Returns 401 (empty body) |
| `/challenges`                                   | Required (`read:restaurant_challenges`)    | Returns 401 (empty body) |
| `/specials`                                     | Required (`read:restaurant_specials`)      | Returns 401 (empty body) |
| `/users/me/*`, `/payment_intents/*`             | Returns 401 (empty body)                   | Required                 |

<Tip>
  **From the kitchen** - Discovery routes use the API key. Member-acting
  routes use OAuth. The two do not substitute for each other.
</Tip>

<Warning>
  **Chef's warning** - API keys are **server-side only**. Every call
  that carries an API key must originate from your backend, never
  from a browser, mobile client, or any code shipped to users. Don't
  embed them in client-side bundles, public repos, screenshots, or
  environment variables checked into source. A key visible in a
  client is a key you have to assume is compromised. Treat them as
  you would a password, and route Discovery calls through your own
  backend rather than calling the API directly from the client.
</Warning>

## If a key leaks

Contact Blackbird support to revoke and issue a new key. Old keys
stop working immediately on revocation.

## Mixing environments

Don't reuse a key across environments. Your `fly_test_` staging key
authenticates against the staging API; your `fly_live_` production key
authenticates against the production API. They're issued separately and
aren't substitutes for each other.