Authentication

The Partner API uses a single secret key sent in the X-Api-Key header. One key is bound to exactly one owner account, and every response is scoped to that owner's own cars, drivers, bookings, tolls and violations.

Getting a key

Keys are issued, rotated and revoked by MyEZToll support. Once a key is issued, the owner sees it read-only in the owner portal, on the Owner Settings tab. Ask support for a sandbox key as well — sandbox keys are separate and never touch production data.

Using the key

Send the header on every /api/partner/v1/** request. A missing, unknown or revoked key returns 401 with the standard error envelope. Nothing else — no OAuth flow, no token exchange, no expiry — is involved.

Call the API from your server only. The key is a full-access credential for your account: never ship it in a browser bundle, a mobile app, or a public repository. Store it in an environment variable or a secret manager.

Rotation and revocation

Rotating issues a new key and invalidates the old one immediately, so deploy the new value before asking for a rotation. If a key leaks, ask support to revoke it — every request with that key starts failing with 401 at once.