Using the API
The AKIN Travel platform is a single GraphQL API over HTTP. Any language or framework can use it — the React SDK is just a wrapper around this same endpoint.
Endpoint
| Environment | URL |
|---|---|
| Sandbox | https://staging-api.akintravel.com/graphql |
| Production | https://api.akintravel.com/graphql |
All operations are POST requests with a JSON body of { "query": "...", "variables": { ... } }.
Match the key to the endpoint. API keys are environment-scoped: a
pk_test_*key only authenticates against the sandbox, apk_live_*key only against production. A key sent to the wrong endpoint is rejected with HTTP403and a stablecodeofKEY_ENVIRONMENT_MISMATCH(the body’scorrectEndpointfield names the right URL). Branch oncode, not the message.
Headers
| Header | When | Value |
|---|---|---|
content-type | Always | application/json |
x-partner-api-key | Partner-scoped calls (e.g. requestMagicLink, introspection) | your pk_test_* / pk_live_* key |
authorization | Member-scoped calls | Bearer <Firebase ID token> |
The partner API key identifies your partner and gates schema introspection; the bearer token identifies the signed-in member. See Authentication for how to obtain the ID token.
Header name: the partner GraphQL endpoint reads
x-partner-api-key. A separatex-api-keyheader exists on the MCP route (/mcp) — it is a different endpoint with different authentication. If you seeINTROSPECTION_DISABLEDerrors, check that you are sendingx-partner-api-key, notx-api-key.
A request
curl https://staging-api.akintravel.com/graphql \
-H 'content-type: application/json' \
-H 'authorization: Bearer <FIREBASE_ID_TOKEN>' \
-d '{"query":"query($id:ID!){ memberProfile(id:$id){ membershipYearStats{ akinPoints totalStays } } }","variables":{"id":"MEMBER_ID"}}'{
"data": {
"memberProfile": {
"membershipYearStats": { "akinPoints": 4200, "totalStays": 6 }
}
}
}Discovering the schema
With a valid API key you can introspect the partner-scoped schema from any GraphQL tool, or read the always-current GraphQL reference — it’s generated from the API source, so it never drifts. The schema is filtered to the partner surface; internal fields are not exposed.
Errors
Failures come back as GraphQL errors with a stable extensions.code. Branch on the code, never the message — see Error handling.
Rate limits
Requests are limited per API key and report RateLimit-* headers. See Rate limits.