Authentication

All API requests require authentication using an access token provided by Project Expedition.

Obtaining an Access Token

1. Register an account at projectexpedition.com
2. Contact partners@projectexpedition.com to request API access
3. Receive your access token via email after approval

Caution

Keep your access token secure. Never expose it in client-side code or public repositories.

Using the Access Token

Include your token in the access-token header with every request:

curl

curl -H "access-token: YOUR_TOKEN_HERE" \
  "https://apistage.projectexpedition.com/v1/return_tours?country=ireland"

JavaScript

const response = await fetch(
  'https://apistage.projectexpedition.com/v1/return_tours?country=ireland',
  {
    headers: {
      'access-token': 'YOUR_TOKEN_HERE'
    }
  }
);

PHP

<?php
$context = stream_context_create([
    'http' => [
        'header' => 'access-token: YOUR_TOKEN_HERE'
    ]
]);

$response = file_get_contents(
    'https://apistage.projectexpedition.com/v1/return_tours?country=ireland',
    false,
    $context
);

Header Reference

Header	Description
access-token	Your API token (required for all requests)
Content-Type	Set to application/json for POST/PUT requests

Authentication Errors

Invalid Token

{
  "error": "Invalid access token"
}

This occurs when:

• The token is missing from the request
• The token is malformed or expired
• The token has been revoked

IP Not Whitelisted (Production Only)

{
  "error": "Invalid request: IP address not whitelisted."
}

Production API calls must originate from whitelisted IP addresses. Contact Project Expedition to add your IP addresses.

Tip

The staging environment does not require IP whitelisting, making it ideal for development.

Token Best Practices

1. Store Securely - Use environment variables or secure secret management
2. Server-Side Only - Never expose tokens in client-side JavaScript
3. Rotate Regularly - Request a new token if you suspect compromise
4. Separate Tokens - Use different tokens for staging and production if possible

Environment Variables Example

# .env file (never commit this)
PE_API_TOKEN=your_token_here

Node.js

const token = process.env.PE_API_TOKEN;

const response = await fetch(url, {
  headers: {
    'access-token': token
  }
});

<?php
// PHP
$token = getenv('PE_API_TOKEN');

$context = stream_context_create([
    'http' => [
        'header' => "access-token: $token"
    ]
]);

Need Help?

If you’re having authentication issues:

1. Verify your token is correct (no extra spaces or characters)
2. Check that you’re using the correct environment URL
3. For production, confirm your IP is whitelisted

Email: partners@projectexpedition.com