Never put a key in a URL or in code that runs in a browser or a mobile app: anyone who can read it can spend your allowance. Call the API from your server and pass the results on.

Live and test keys

A key is pk_live_ or pk_test_, followed by 40 letters and digits.

	Test keys (`pk_test_`)	Live keys (`pk_live_`)
Data	Real clubs, coaches, events and availability	The same
Bookings	Fully checked, answered with a `TEST` reference, never stored, no email to the guest	Stored, the guest is emailed to pay
Plans	Every plan, including the free sandbox	Paid plans only
Counts against your allowance	Yes	Yes

Every answer tells you which kind of key it saw in the X-Rally-Mode header (live or test).

Creating, naming, rotating and revoking

On the dashboard you can have up to 10 active keys. Give each a name that says where it is used, for example "Booking engine" or "Staging".

Create: the full key is shown once. Copy it into your secret store straight away.
Rotate: issues a new key with the same name and mode and revokes the old one at once. Deploy the new key before you rotate if you cannot afford a gap, or create a second key, switch over, then revoke the first.
Revoke: the key stops working immediately. Calls with it answer 401 key_revoked.

Creating or rotating a live key needs an authenticator app on your developer account. Set it up on the Security page of the developer centre. This protects the keys that can create real bookings in your name.

Live keys and payments

Live keys work while your paid plan is paid up. If a payment fails, live keys keep working for 7 days while the card is retried or replaced. After that they answer 403 live_keys_off until a payment goes through. Test keys keep working throughout.

What the errors mean

Status	Code	What happened
401	`missing_key`	No `Authorization: Bearer` header
401	`invalid_key`	The key does not exist, or was not copied in full
401	`key_revoked`	The key was revoked or rotated
403	`partner_paused`	We paused the account; contact support
403	`live_keys_off`	A live key on the sandbox, or after the payment grace period

OAuth for AI assistants

MCP clients that cannot send a header, such as ChatGPT, connect with OAuth instead: you sign in, choose which of your keys the app acts as, and the app gets a token that counts against that key. See the MCP server page.

Live and test keys

Creating, naming, rotating and revoking

Two-factor sign-in for live keys

Live keys and payments

What the errors mean

OAuth for AI assistants

Authentication and keys | Developer centre