> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rollinggo.store/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys for Enterprise and Developer Partners — RollingGo

> Learn how to find, use, and secure your RollingGo API Key for Enterprise and Developer integrations with the RollingGo travel MCP platform.

Your API Key is your primary credential for calling RollingGo's travel MCP endpoints. It is displayed immediately after you submit your application — copy it right away and store it somewhere safe.

## Where to Find Your Key

You can access your API Key in two places:

<CardGroup cols={2}>
  <Card title="Success Screen" icon="circle-check">
    Your key appears on the confirmation screen immediately after you submit your application. This is the easiest moment to copy it.
  </Card>

  <Card title="Partner Center Dashboard" icon="key">
    Navigate to **Settings → API Keys** in your Partner Center dashboard to view or manage your keys at any time.
  </Card>
</CardGroup>

## Using Your API Key in Requests

Include your API Key as a Bearer token in the `Authorization` header of every request you make to the RollingGo API.

```http theme={null}
GET https://api.rollinggo.ai/v1/travel/search
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
```

<Note>
  If you are a **China Mainland partner**, replace `api.rollinggo.ai` with `api.rollinggo.cn` in all request URLs.
</Note>

### Setting Your Key as an Environment Variable

Always load your API Key from an environment variable rather than writing it directly in your code.

```bash theme={null}
export ROLLINGGO_API_KEY="rg_live_xxxxxxxxxxxxxxxxxxxx"
```

Then reference it in your application:

```javascript theme={null}
const apiKey = process.env.ROLLINGGO_API_KEY;

const response = await fetch('https://api.rollinggo.ai/v1/travel/search', {
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json'
  }
});
```

## Security Best Practices

Follow these guidelines to keep your API Key secure and your integration protected.

<AccordionGroup>
  <Accordion title="Never expose your key in client-side code or public repositories">
    API Keys embedded in front-end JavaScript, mobile app binaries, or version-controlled source files can be harvested by third parties. Always keep your key on the server side and out of any public repository.
  </Accordion>

  <Accordion title="Store keys in environment variables, not hardcoded">
    Hardcoded credentials create a permanent security risk that survives every code change. Use environment variables or a secrets manager so you can rotate keys without touching your codebase.
  </Accordion>

  <Accordion title="Use separate keys for development and production">
    Create additional API Keys from the **Settings → API Keys** section of your dashboard. Keeping development and production keys separate limits the blast radius of an accidental exposure.
  </Accordion>

  <Accordion title="Regenerate a compromised key immediately">
    If you believe your key has been exposed, go to **Settings → API Keys** in your Partner Center dashboard and regenerate it right away. Your old key is invalidated the moment you regenerate.
  </Accordion>
</AccordionGroup>

<Warning>
  API Keys **cannot be retrieved** after you leave the success screen if you did not copy them. If you lose your key, generate a new one from **Settings → API Keys** in your Partner Center dashboard. The original key cannot be recovered.
</Warning>

***

For a complete reference on authentication flows, token scopes, and error handling, see the [Authentication guide](/api/authentication).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.