Aviation Edge Authentication

generated: '2026-09-04'
method: searched
source: >-
  https://aviation-edge.com/developers/ and https://aviation-edge.com/free-api-key/, the
  first-party request examples at https://github.com/AviationEdgeAPI, live probes of
  https://aviation-edge.com/v2/public/ on 2026-09-04, and the securitySchemes declared in
  openapi/_original/aviation-edge-openapi.yml.
docs: https://aviation-edge.com/developers/
summary:
  types:
  - apiKey
  api_key_in:
  - query
  oauth: false
  mtls: false
  scopes: false
  note: >-
    One credential model, applied uniformly to all 17 operations: a subscription API key in
    the `key` query parameter. There are no scopes, no header alternative, no OAuth surface
    and no service accounts, so an agent's access is all-or-nothing per key.
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: query
  parameter: key
  description: >-
    API key issued with an Aviation Edge subscription and passed as the `key` query parameter
    on every request, e.g. https://aviation-edge.com/v2/public/flights?key=YOUR_KEY&limit=100
  required: true
  applies_to: all operations
  sources:
  - openapi/_original/aviation-edge-openapi.yml
  - https://aviation-edge.com/developers/
key_issuance:
  self_serve: true
  url: https://aviation-edge.com/premium-api/
  free_tier: false
  note: >-
    Keys are issued on paid subscription and delivered by email and in the account dashboard
    (https://aviation-edge.com/subscribe/login.php). The free API key was withdrawn — see
    https://aviation-edge.com/free-api-key/ — so there is no anonymous or trial credential.
  rotation: not documented
  expiry: not documented
failure_modes:
- condition: no key supplied
  http_status: 200
  body: '{"message":"Missing API Key","success":false}'
- condition: invalid key
  http_status: 200
  body: '{"error":"Invalid API Key","success":false}'
- note: >-
    Authentication failures are returned with HTTP 200. A client must inspect `success` in the
    body; branching on the status code alone will read a rejected call as an empty result set.
    See errors/aviation-edge-problem-types.yml.
cautions:
- >-
    The credential travels in the query string, so it is exposed to server logs, proxy logs,
    browser history and Referer headers. Aviation Edge offers no header-based alternative.
- >-
    Transport is TLS 1.3 with HSTS (see security/aviation-edge-domain-security.yml), so the key
    is not exposed on the wire, only in whatever records the URL.