Authentication

Every request (except the public health check) is authenticated with a Bearer API key in the Authorization header. RYNT issues your key when your partner account is approved; it is shown once — store it securely.

curl https://api-dev.rynt.ae/api/partner/v1/me \
  -H "Authorization: Bearer pk_test_your_key"

A successful response confirms your identity, environment, and scopes:

{
  "data": {
    "partner_id": "…",
    "type": "agency",
    "environment": "sandbox",
    "scopes": ["read", "vehicle:write", "booking:write"]
  },
  "request_id": "req_…"
}

Scopes

Keys are scoped — ask for only what you need.

Scope	Grants
`read`	List vehicles & bookings
`vehicle:write`	Mapping, enable/disable, blocks
`booking:write`	Approve / reject / cancel / pickup / return

🚧
Keep your key secret
Your API key grants access to your data. Never expose it in a browser or mobile app, and rotate it immediately if it leaks. Managing your own webhooks works with any valid key.

Sandbox vs Production

Test keys (pk_test_…) work only against the sandbox base URL; live keys (pk_live_…) only against production. Build and verify everything on sandbox, then swap both the base URL and the key.