Authentication

Sending the key

curl https://app.journeystack.co/api/public/v1/plans?limit=1 \
  -H "Authorization: Bearer $JS_KEY"

# X-API-Key is also accepted for clients that cannot set Authorization
curl https://app.journeystack.co/api/public/v1/plans?limit=1 \
  -H "X-API-Key: $JS_KEY"

Environments

• js_test_ keys run in sandbox: nothing is provisioned on the live network, no real money moves, orders return realistic test eSIMs.
• js_live_ keys run in production: real eSIMs, real balance.
• Orders, eSIMs, wallets and webhooks are separated by environment. A sandbox order is never visible to a live key.
• There is no environment parameter — swapping the key is the whole switch.

Rate limits

The default limit is 120 requests per minute per partner account, counted on a rolling 60 second window across all your keys. Exceeding it returns HTTP 429 with a Retry-After header of 60 seconds. Ask support if your volume needs a higher ceiling.

Error envelope

{
  "error": {
    "code": "insufficient_funds",
    "message": "Your wallet balance is too low for this order."
  }
}

Validation failures add an `error.details` array naming each offending field. Codes are stable; messages are for humans and may be reworded.

CORS and clients

The API sends permissive CORS headers so you can prototype from a browser, but you should call it from your server. A key in front-end code can be read by anyone.