Skip to content
traveldistro home

Developers

Authentication

What is it

traveldistro authentication is TD-HMAC-SHA256 request signing. The Authorization header carries a key id and a signature; the X-TD-Timestamp and X-TD-Nonce headers bind each signature to a single moment and a single request.

Capabilities

  • The signature

    HMAC-SHA256, keyed by your secret, over method, path, sorted query, timestamp, nonce and the body's SHA-256 hash.

  • Replay protection

    Timestamps must be within 300 seconds of server time and nonces are rejected on reuse.

  • No bearer tokens

    There is nothing to steal and replay. A signature is valid for one request only.

Authorization header

Authorization: TD-HMAC-SHA256 KeyId=key_29xk, Signature=9f41…
X-TD-Timestamp: 1785603201   # ±300s
X-TD-Nonce: 5b1e-8c02        # single use

Frequently asked questions

Where do I find my secret?
It is issued with your key when access is provisioned. Store it server-side; it is never sent on the wire.
What does a failed signature return?
A 401 with a machine-readable error body, so you can distinguish signing bugs from business errors.

Related pages

Ready to integrate?

Tell us about your volume and verticals. We will get you sandbox keys.

Contact us