Authentication and Security

View as Markdown

API Credentials

All requests to CabFare Connect must be authenticated using two custom HTTP headers. These credentials are issued by CabFare and are unique to your integration.

Header	Type	Description
X-API-KEY	string	Your unique partner identifier
X-API-SECRET	string	Your private authorisation token

Both headers must be present on every API request. Requests missing either header will receive a 401 Unauthorized response.

Requesting Credentials

Credentials are not available through self-service. To request your sandbox or production credentials contact the CabFare integration team at support@cabfare.com.

Separate credentials are issued for:

• Sandbox — for development and testing only
• Production — issued after successful certification of your integration

Do not use sandbox credentials against the production API or vice versa.

Security Requirements

• All API communication must use HTTPS with TLS 1.2 or higher
• Credentials must be stored securely on your device or server and must never be exposed in client-side code, logs, or shared documents
• If you believe your credentials have been compromised, contact support@cabfare.com immediately to arrange rotation
• For inbound events received from CabFare Connect, validate that the X-API-KEY header matches your issued key before processing the request