Authentication
All requests use your FetchLayer API key as a Bearer token. There is no airline or agency account to create and no OAuth flow — one header and a JSON body is the whole integration.
Sending requests
bash
curl -X POST https://api.fetchlayer.dev/flights/search \
-H "Authorization: Bearer ss-your-key" \
-H "Content-Type: application/json" \
-d '{"origin":"JFK","destination":"LHR","departureDate":"2026-10-15"}'Keep your key secret
Only use API keys in server-side code and rotate a key immediately if it is exposed.
One route, and it is a POST
The single route takes a JSON body over POST, so nothing travels in a URL. The body is a strict object: an unrecognised field is rejected with a 400 naming it — {"error":"Unrecognized key: \"sortBy\""} — rather than quietly ignored, so a typo never returns silently wrong data. Three fields are required: origin, destination and departureDate. The two codes must be three letters and the date must not be in the past; either mistake is a 400 that names it.
Authentication errors
A missing or invalid key returns HTTP 401. A key scoped to other platforms returns HTTP 403.
json
{
"error": "Invalid API key"
}