1. Access
API keys identify your application. Keep them secret; each key carries only the scopes you grant it. Rotate a key immediately if it may have leaked — we show the full key only once.
2. Plans and fair use
Free, Partner and Enterprise plans include the request quotas shown in the portal. Sandbox keys (ttk_test_…) never touch live bookings or payments.
3. Data use
Respect the privacy class of the data you receive. Public network data may be displayed with attribution; tenant data may only be used for the operator that granted access. Never re-identify riders or sell location data.
4. AI agents and MCP
Agents connected to the MCP server act within the scopes of the key or the user who authorised them. High-risk tools require explicit user confirmation; you must not simulate or bypass it.
5. Webhooks
Verify the teletransit-signature header on every delivery and respond within 10 seconds; failed deliveries are retried with exponential back-off.
6. Suspension
We may suspend keys that endanger riders, operators or the platform, and will tell you why.