Get started
Authentication
Bearer keys, the per-product prefixes, and the one family credential.
Every authed request carries an API key as a bearer token in the Authorization header.
curl https://api.navo24.com/v1/tracking/containers \
-H "Authorization: Bearer tmcp_YOUR_API_KEY"Most products also accept the key in an x-api-key header. Bearer is the norm across the family, so prefer it.
Key prefixes
The prefix names the product a key was minted for. Read it as the product tag, not a secret you can shorten. Every product answers on one host, https://api.navo24.com, under its own prefix, so one client, one auth header and one error shape cover the whole family.
| Product | Prefix | Base URL |
|---|---|---|
| Container Tracking | tmcp_ |
https://api.navo24.com/v1/tracking |
| Air Cargo | tmcp_ (family) |
https://api.navo24.com/v1/air |
| Schedules & Reliability | smcp_ (or tmcp_ family) |
https://api.navo24.com/v1/schedules |
| Load Planning | lmcp_ (or tmcp_ family) |
https://api.navo24.com/v1/loading |
| Freight Rates | frm_ (or tmcp_ family) |
https://api.navo24.com/v1/rates |
| Distance, Maps, Carbon | tmcp_ |
https://api.navo24.com/v1/distance, /v1/geo, /v1/maps, /v1/carbon |
| Parcel, Vessel, Road, Rail, D&D | tmcp_ |
https://api.navo24.com/v1/parcel, /v1/vessel, /v1/road, /v1/rail, /v1/dd |
| Flight Schedules | tmcp_ |
https://api.navo24.com/v1/flight |
The older per-product hosts (api.trackingmcp.com and the rest) still answer, so existing integrations keep working. New code should use api.navo24.com.
Public endpoints
Some routes are open and need no key at all: the public container lookup, air-waybill prefix resolution, and the schedules reference lists (/v1/schedules/carriers, /v1/schedules/ports/search). They are rate-limited by IP. The schedules data endpoints (sailings, reliability, port congestion) need a key. The reference marks each endpoint as No key or API key, and that badge is the answer; SchedulesMCP also explains how calls are counted.
The family key
AirCargoMCP validates the shared Navo24 family credential, so a tmcp_ key that works for tracking also tracks air waybills. SchedulesMCP accepts it too, alongside its own smcp_ keys, and counts its calls against the same SchedulesMCP limit. Other products keep their own prefix. If you hold a single account across the suite, you will usually carry one key per product plus the family key for air cargo.
Keeping keys safe
- Send keys only from your backend. Never ship a live key in browser code or a mobile bundle.
- Rotate on exposure. Mint a new key, cut the old one over, then revoke it.
- Scope by environment. Keep a separate key for staging so you can revoke it without touching production.
If a request is missing or has a bad key, the API answers 401 with an error envelope. See errors and rate limits.