PureTrack API Authentication

PureTrack data APIs use an application API key. Some APIs also require a PureTrack Pro user access token. Contact us to obtain an API key for your application.

The API key identifies the application making the request and controls its capabilities.
Approved keys may be configured for API access without a user login or token.
APIs requiring Pro must also send a user access token belonging to a current PureTrack Pro user.

1. Log in and obtain an access token, when required

POST https://puretrack.io/api/login

Send the application API key, the user's email address, and the user's PureTrack password as JSON.

Field	Required	Description
`key`	Yes	Your application API key.
`email`	Yes	The user's PureTrack email address.
`password`	Yes	The user's PureTrack password.

curl -X POST "https://puretrack.io/api/login" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "your-application-api-key",
    "email": "pilot@example.com",
    "password": "user-password"
  }'

Login response

{
  "access_token": "123|example-access-token",
  "pro": true
}

access_token is the user's bearer token. Store it securely and use it for future API requests.
pro indicates whether the user currently has access to PureTrack Pro features.

Do not store the user's password. Ask the user to enter it again if a new token is required. Tokens currently have no automatic expiry, but they can be revoked or replaced.

2. Authenticate API requests

Always send the application API key in the X-API-Key header. If your key requires a Pro user, also send the access token in the standard Authorization header:

Authorization: Bearer your-access-token
X-API-Key: your-application-api-key
Accept: application/json

Example:

curl "https://puretrack.io/api/locations/flights?location=78969&start_date=2026-09-01&end_date=2026-09-30" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer your-access-token" \
  -H "X-API-Key: your-application-api-key"

PureTrack first-party native tokens carrying the native ability do not require the X-API-Key header.

Security

Always use HTTPS.
Never put an access token or API key in a URL or query parameter. URLs are commonly stored in browser history, access logs, proxies, and analytics systems.
Never expose an application API key in client-side web JavaScript.
Treat access tokens and API keys as secrets. Replace them if they are exposed.

Log out

POST https://puretrack.io/api/logout

Send the bearer token in the Authorization header. The current logout endpoint revokes all API tokens belonging to that user.

curl -X POST "https://puretrack.io/api/logout" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer your-access-token"

Common authentication errors

Status	Meaning
`401 Unauthenticated`	The bearer token is missing, invalid, or revoked.
`401 API key not provided`	The `X-API-Key` header is required but missing.
`401 API key not correct`	The application API key is invalid.
`403 User Not Pro`	The user is authenticated but does not currently have a Pro subscription.