Authentication

Every request is authenticated with an API key sent in the user-token HTTP header. There is no login or OAuth flow: your KAM at Rappi Cargo provisions the token for your account.

Send it on every call:

user-token: YOUR_TOKEN

A missing or invalid token returns 401 Unauthorized.

Tokens are environment-specific

A token issued for dev does not work in production, and a production token is tied to a single country. Request one per environment you integrate against.

Keep it server-side

The token identifies your whole account. Never ship it in a mobile app, a browser bundle or a public repository. Load it from an environment variable or a secrets manager.

With the SDKs you pass it once when you create the client, and the SDK sends the header on every call. See the TypeScript and Python quickstarts.