Authentication

Every Partner API request must include both headers:

X-API-Key: <your-api-key>
X-Client-ID: <your-client-id>
Content-Type: application/json

Missing or invalid credentials return 401 Unauthorized.

Credential lifecycle

Stage	How credentials are issued
Sandbox	After requesting access; Lynq operations emails UAT keys
Production	After successful UAT testing and go-live review

Store API keys in a secrets manager. Never embed keys in mobile apps or front-end bundles.

IP allowlisting

If your partner profile has an IP allowlist configured, requests must originate from listed addresses (or from an egress proxy Lynq has approved). Blocked IPs receive 403 Forbidden.

Webhook signing (inbound to your servers)

Outbound webhooks from Lynq use a separate signing secret returned once when you POST /webhooks. Verify X-Lynq-Signature on the raw request body — see Webhooks and Tools.

Scalar / Postman

• The API reference persists auth in your browser (persistAuth) for UAT testing.
• Import lynq-partner-api.postman_collection.json and set collection variables for base_url, api_key, and client_id.

Example

curl -X POST 'https://uat-api.lynq-sa.com/partner/quotes' \
  -H 'X-API-Key: YOUR_KEY' \
  -H 'X-Client-ID: YOUR_CLIENT_ID' \
  -H 'Content-Type: application/json' \
  -d '{
    "pickup": {"lat": 24.7136, "lng": 46.6753},
    "dropoff": {"lat": 24.768, "lng": 46.709}
  }'