Getting started · Authentication
Authentication
Every `/v1/*` endpoint requires an `X-API-Key` header — including the health probe, the reference catalogue, the Aviation Data API and the authenticated Shopping / Orders surfaces. Requests without the header (or with an unknown key) are rejected with `401 Unauthorized`.
How to authenticate
Get your API key from the Norba dashboard, then send it as the `X-API-Key` header on every request.
# 1. Export the key issued from the dashboard
export NORBA_KEY="nbr_live_a8b…"
# 2. Send it as X-API-Key on every request — public or authenticated.
curl --request GET \
--url https://api.norba.io/v1/aviation/airports \
--header "X-API-Key: $NORBA_KEY"
curl --request POST \
--url https://api.norba.io/v1/shopping/offers \
--header "X-API-Key: $NORBA_KEY" \
--header "Content-Type: application/json" \
--data '{ "origin": "LHR", "destination": "JFK", "departure_date": "2026-06-15", "adults": 1 }'API key details
| Property | Details |
|---|---|
| Header name | X-API-Key |
| Format | Opaque string, prefixed with environment (nbr_live_*, nbr_test_*) |
| Where to get it | Norba dashboard → API Keys section |
| Environment | One kind of key, two environments. A sandbox key (nbr_test_) reaches the airlines' test systems; a production key (nbr_live_) reaches live systems and can be created once your agency is live. An agency can record its IATA/BSP accreditation number in the dashboard at onboarding — optional, but only an accredited agency can issue in production for now. |
| Rotation | Rotate from the dashboard: a replacement is issued and shown once, and the old key is revoked immediately. |
Common auth errors
| HTTP | Error code | Meaning |
|---|---|---|
| 401 | missing X-API-Key | The header was absent. Every /v1/* path needs it except GET /v1/health and GET /v1/health/ready. |
| 401 | invalid api key | The key is not a valid Norba API key — revoked, mistyped, or from another environment. |
| 401 | unauthorized | Returned by GET /v1/orders when the key is valid but has no agency behind it — a static key cannot scope an order list. |
| 402 | payment_required | A developer-portal key that has exhausted the free allowance — a one-off for the life of the account, not a monthly ration — with no payment method on file. Three other reasons share this status, and a fourth (an unrecognised plan) answers 403 instead — see Billing & Payments. |
The full 402 reason vocabulary, what triggers each one, and how to check an account’s standing before it happens are on Billing & Payments.