Chapter Five · The Rules of Entry
Keys and Authentication
Every request so far walked in unannounced, and the public station data did not mind. The rides do. This chapter is the door: why it exists, how Vera gets through it, and what she is holding once she does. A key arrives in an email and turns a refusal into data with one header. That key turns out to be a password with a longer name, worth the same care and the same rotation habit. Some credentials die on a schedule, which explains the most common support ticket in existence. And the consent screen you click through every week gets read properly, once, so you never click one blindly again.
Chapter 3 put a command line in your hands and Chapter 4 taught you to read what came back. Neither chapter ever had to say who you were. Tandem's station data is open — anyone may look — so the requests went out anonymous and came back full. That run of luck ends at the rides endpoint, and it ends with three digits: 401 Unauthorized. Nothing broke. The API asked a question, and the request had no answer in it.
The question is the whole chapter. An API that knows who is asking can count requests fairly, bill honestly, revoke a troublemaker, and help a partner who writes in. An API that does not know can only be used until it falls over. So Tandem asks for a name on the envelope, and by the end of these five pages you will know exactly what to put there, how to carry it safely, why some credentials expire on purpose, and what really happens when an app asks to use your account somewhere else.