ELAELA Docs

Authentication

Authenticate with organization-scoped API keys and use idempotency for public writes.

At a glance

Every public Partner API request uses X-ELA-API-Key. Every mutating request also requires Idempotency-Key so retries do not create duplicate bookings or payments.

API keys

API keys are scoped by active partner organization, active requester membership, and key capability. Never expose raw keys in browser code, mobile apps, logs, or support tickets.

Authenticated requestbash
curl https://services.enviablelogistics.com/api/v1/partner-api/hubs \  -H "X-ELA-API-Key: ela_live_xxx"

Idempotency

Mutating request headersbash
curl -X POST https://services.enviablelogistics.com/api/v1/partner-api/booking-quotes \  -H "X-ELA-API-Key: ela_live_xxx" \  -H "Idempotency-Key: quote-demo-1001" \  -H "Content-Type: application/json" \  -d '{ "serviceType": "CLICK" }'

Secret handling

  • Store API keys in a server-side secret manager.

  • Mask keys in logs and observability tools.

  • Rotate credentials if they appear in chat, source code, or public error reports.

  • Use only production credentials issued by ELA for live traffic.