Authentication
All API requests (except checkout) require a Bearer token in the Authorization header.
Header
Authorization: Bearer otg_live_xxxxxxxxxxxxxxxx
# or
Authorization: Bearer otg_test_xxxxxxxxxxxxxxxxKey types
| Param | Type | Description |
|---|---|---|
otg_live_…required | string | Production key. Charges 1 stop per stop in the request. Full features including address geocoding. |
otg_test_…optional | string | Sandbox key. Never charges. Coordinates only, max 10 stops/call. Create in Console → Sandbox. |
Where to get keys
- Live — buy a pack (key emailed) or create additional keys in Console → Keys if you already have a balance
- Test — up to 3 active keys in Console → Sandbox
Security
- Keys are stored hashed (SHA-256) — plaintext is shown only at creation
- Revoke compromised keys immediately from the console
- Prefer sandbox keys during development and CI