Authentication

Authenticated v302 endpoints use a personal owner API token. The token identifies the account and grants access to its vehicle inventory and additional options.

Get a token

1. Sign in to getrentacar.com as a Vehicle Owner.
2. Open the account profile and locate the API access section.
3. Generate a token if the account does not already have one.
4. Copy it immediately into your server-side secret storage.

The owner ID shown in the same profile is used as user_id by vehicle management methods.

Resetting a token immediately invalidates the previous token. Rotate it only after every integration has been updated.

Send the token

Use the standard Authorization request header:

Authorization: Bearer {YOUR_API_TOKEN}

Example:

curl --request GET \ --url "https://getrentacar.com/api/v302/vehicles/list?user_id=<USER_ID>&locale_id=40" \ --header "Accept: application/json" \ --header "Authorization: Bearer {YOUR_API_TOKEN}"

Security requirements

• Never commit a token to Git or include it in screenshots, browser URLs, analytics, or logs.
• Keep production and test credentials separate.
• Send requests only over HTTPS.
• Store tokens in an encrypted secrets manager or protected environment variable.
• Rotate a token immediately if it may have been exposed.
• Do not place the token in the query string. The legacy api_key parameter exists for compatibility but should not be used for new integrations.

Authentication errors