# Authentication and Security

## API Credentials

All requests to CabFare Connect must be authenticated using two custom HTTP headers. These credentials are issued by CabFare and are unique to your integration.

| Header         | Type     | Description                      |
| -------------- | -------- | -------------------------------- |
| `X-API-KEY`    | `string` | Your unique partner identifier   |
| `X-API-SECRET` | `string` | Your private authorisation token |

Both headers must be present on every API request. Requests missing either header will receive a `401 Unauthorized` response.

## Requesting Credentials

Credentials are not available through self-service. To request your sandbox or production credentials contact the CabFare integration team at [support@cabfare.com](mailto:support@cabfare.com).

Separate credentials are issued for:

- **Sandbox** — for development and testing only
- **Production** — issued after successful certification of your integration

Do not use sandbox credentials against the production API or vice versa.

## Security Requirements

- All API communication must use HTTPS with TLS 1.2 or higher
- Credentials must be stored securely on your device or server and must never be exposed in client-side code, logs, or shared documents
- If you believe your credentials have been compromised, contact [support@cabfare.com](mailto:support@cabfare.com) immediately to arrange rotation
- For inbound events received from CabFare Connect, validate that the `X-API-KEY` header matches your issued key before processing the request

---
Source: https://docs.cabfare.com/api/authentication-and-security