Authentication

Every request must be authenticated with your API token.

Getting a token

Two ways to get one:

Trial key: self-serve, ready in a minute once you confirm your email. It covers India as a destination, with 100 requests per month.
Partner key: every destination, with the volume you need. It is free in most cases: we dedicate the API to travel professionals (agencies, tour operators, OTAs, airports…) who also offer Visamundi’s visa assistance to their customers. Request access and we’ll set you up.

Keys limited to some destinations answer 403 with code plan_restricted for any other destination (see Errors).

Sending the token

The API accepts the token two ways. Use the Authorization header wherever possible; the query parameter is a fallback for environments that can’t set headers.

Authorization header (recommended)

curl https://connect.visamundi.io/v3/countries \
  -H "Authorization: Bearer YOUR_TOKEN"

`access_token` query parameter

curl "https://connect.visamundi.io/v3/countries?access_token=YOUR_TOKEN"

Verifying it works

The quickest check is the /hello endpoint — a lightweight authenticated ping. A valid token returns 200 with data: "Hello World!":

curl https://connect.visamundi.io/v3/hello \
  -H "Authorization: Bearer YOUR_TOKEN"

{ "success": true, "statusCode": 200, "code": "ok", "data": "Hello World!" }

A missing or invalid token returns 403:

{
  "success": false,
  "statusCode": 403,
  "code": "invalid_api_key",
  "message": "API key is invalid or missing to access to the requested resource"
}

You can test your token live in the API reference — set it once in the authentication panel and every “try it” call will use it.