Authentication

Every authenticated v5 request carries your API key in the api-key header:

curl https://api.transdirect.com.au/api/v5/member \
  -H "api-key: $TD_API_KEY"

A key belongs to one Transdirect member account. Every booking, order and payment method the API returns is that account’s. The endpoints on this site take no other credential: no username and password, no OAuth and no bearer tokens.

Get a key

1. Sign in at members.transdirect.com.au (no account yet? Sign up).

2. Go to Settings, then Integrations (direct link).

3. Find Custom API and click Connect. If you already have a Custom API key, the button is Add another store.

4. In the Connect Custom API dialog, enter the URL of the site or app that will use the key and tick the box to accept the Transdirect Terms and Conditions and the Transit Warranty terms. Click Connect.

5. The key appears on the new row in Your connections. Click the copy icon next to it. The key is also shown as API Key on the row’s Settings page.

Accepting the Terms and the Transit Warranty terms is part of creating the key, so individual API requests do not need to accept them again.

The store plugins (WooCommerce, Shopify, Magento and others) have their own cards on the same page; see plugins. Use a Custom API key for your own code. Transdirect never asks you to paste or email a WooCommerce consumer key and secret. If you have shared one, revoke it in WooCommerce.

Demo mode is set on the key

Each key has its own Demo courier switch. Open the ⋯ (More actions) menu on the key’s row and tick Demo courier. With it on, quotes for that key include a free demo courier, so you can test the whole flow without being charged. The change reaches the key’s quotes within about a minute. See testing with demo mode.

Test your key

GET /api/v5/member returns the account the key belongs to:

curl https://api.transdirect.com.au/api/v5/member \
  -H "api-key: $TD_API_KEY"

{
  "id": 12345,
  "company_name": "Example Pty Ltd",
  "contact_name": "Alex Chen",
  "address": "1 George Street",
  "suburb": "SYDNEY",
  "postcode": 2000,
  "state": "NSW",
  "phone": "0291234567",
  "discount_factor": 0,
  "credit_limit": 0,
  "credit_limit_available": 0,
  "charge_type": null,
  "last_invoice_timestamp": null,
  "terms": null,
  "active": 1
}

See get member for every field. You can also paste the key into the API Explorer and send this request from your browser.

The header

• The header name is api-key. Header names are not case-sensitive, so Api-Key and API-KEY also work.
• X-API-Key, api_key (with an underscore) and Authorization: Bearer ... are not read. A request that uses them is treated as having no key.
• Send the key on every request that needs it. Some endpoints, such as tracking, locations and couriers, work without a key.

Errors

Status	Body	Meaning
401	{"error":"missing_api_key"}	No api-key header reached the API. Check the header name.
401	{"error":"invalid_api_key"}	The key is not recognised, or it has been deactivated.
429	{"error":"rate_limited"}	More than 600 requests in a minute on this key. Wait the number of seconds in the retry-after header.

A HEAD request without a key gets 401 with no body.

Authentication is checked before the request body, so a request with a bad key returns 401 even if its body is also invalid.

Keep the key on your server

Treat the key like a password. Anyone who has it can book and pay as your account.

• Call the API from your server, not from browser code. The API only accepts browser (CORS) requests from Transdirect’s own sites, so a web page on your domain cannot call it directly anyway.
• Do not put the key in a mobile app, a public repository or a URL.
• Use a separate key for each site or system, so you can turn one off without affecting the others.

Rotate or deactivate a key

All of these are on the key’s row under Settings, then Integrations, in the ⋯ menu.

• Deactivate stops the key working. Activate turns it back on. The key itself does not change.
• Delete disconnects the key permanently.

Deactivating or deleting a key takes effect within about a minute.

There is no button to regenerate a key. To rotate one:

1. Create a new Custom API key (Add another store on the Custom API card).
2. Deploy the new key to your system and check it with GET /api/v5/member.
3. Deactivate the old key, and delete it once you are sure nothing still uses it.

Tip

If a key has leaked, deactivate it straight away, then create a replacement. Allow for the up-to-4-hour delay above before you treat the old key as dead.

Next steps

• Quickstart: book a demo shipment with your key.
• API overview: base URL, errors and rate limits.
• API Explorer: try requests with your key.