Authentication

One header, one credential — an Incoming Secret created in the console.

Incoming Secrets

Create an Incoming secret in the console (Settings → API Keys), or through the regular API with POST /api/v1/secret. The value has the form <secretId>.<random> and is returned once, on create. No endpoint can read it back.

If you lose it, regenerate the secret. Regenerating or deleting a secret invalidates the old value immediately.

Sending the secret

Send the secret in the Authorization header on every call. A Bearer prefix is accepted and equivalent.

curl "https://next.amfg.ai/engine-service/public-api/v1/ticket-quote" \
  -H "Authorization: <secret>"

curl "https://next.amfg.ai/engine-service/public-api/v1/ticket-quote" \
  -H "Authorization: Bearer <secret>"

The App is derived from the secret itself, so there is no separate API key or App id to send.

IP allowlist

Every Incoming Secret has a non-empty list of allowed IP ranges (ipAddresses). Calls from other addresses are rejected. Use 0.0.0.0/0 to allow any address.

Failures

Every authentication failure returns the same response, whatever the cause: a missing or malformed header, an unknown or revoked secret, or a blocked IP.

401 {"code": 401, "message": "Not Authorized"}

The secret’s usedAt timestamp is updated after each successful call, which helps you spot unused secrets.