API Keys for Enterprise and Developer Partners — RollingGo

Your API Key is your primary credential for calling RollingGo’s travel MCP endpoints. It is displayed immediately after you submit your application — copy it right away and store it somewhere safe.

Where to Find Your Key

You can access your API Key in two places:

Success Screen

Your key appears on the confirmation screen immediately after you submit your application. This is the easiest moment to copy it.

Partner Center Dashboard

Navigate to Settings → API Keys in your Partner Center dashboard to view or manage your keys at any time.

Using Your API Key in Requests

Include your API Key as a Bearer token in the Authorization header of every request you make to the RollingGo API.

GET https://api.rollinggo.ai/v1/travel/search
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

If you are a China Mainland partner, replace api.rollinggo.ai with api.rollinggo.cn in all request URLs.

Setting Your Key as an Environment Variable

Always load your API Key from an environment variable rather than writing it directly in your code.

export ROLLINGGO_API_KEY="rg_live_xxxxxxxxxxxxxxxxxxxx"

Then reference it in your application:

const apiKey = process.env.ROLLINGGO_API_KEY;

const response = await fetch('https://api.rollinggo.ai/v1/travel/search', {
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json'
  }
});

Security Best Practices

Follow these guidelines to keep your API Key secure and your integration protected.

Never expose your key in client-side code or public repositories

API Keys embedded in front-end JavaScript, mobile app binaries, or version-controlled source files can be harvested by third parties. Always keep your key on the server side and out of any public repository.

Store keys in environment variables, not hardcoded

Hardcoded credentials create a permanent security risk that survives every code change. Use environment variables or a secrets manager so you can rotate keys without touching your codebase.

Use separate keys for development and production

Create additional API Keys from the Settings → API Keys section of your dashboard. Keeping development and production keys separate limits the blast radius of an accidental exposure.

Regenerate a compromised key immediately

If you believe your key has been exposed, go to Settings → API Keys in your Partner Center dashboard and regenerate it right away. Your old key is invalidated the moment you regenerate.

API Keys cannot be retrieved after you leave the success screen if you did not copy them. If you lose your key, generate a new one from Settings → API Keys in your Partner Center dashboard. The original key cannot be recovered.

For a complete reference on authentication flows, token scopes, and error handling, see the Authentication guide.

Get Started

Partner Types

Credentials & Access

Guides

Support

API Keys for Enterprise and Developer Partners — RollingGo

Where to Find Your Key

Success Screen

Partner Center Dashboard

Using Your API Key in Requests

Setting Your Key as an Environment Variable

Security Best Practices

​Where to Find Your Key

Success Screen

Partner Center Dashboard

​Using Your API Key in Requests

​Setting Your Key as an Environment Variable

​Security Best Practices

Where to Find Your Key

Using Your API Key in Requests

Setting Your Key as an Environment Variable

Security Best Practices