Start building

New here? Start with Quickstarts

Generate credentials, make your first call, and subscribe to status updates. You can always return to this hub to find the next section you need.

Get credentials Browse APIs

Choose your language

Pick a language-specific track, or follow the universal curl quickstart below.

JavaScript / TypeScript

Node.js with fetch or axios, token caching, retries and idempotency helpers.

Open the JS/TS track

Java

Java 17+, HttpClient and OkHttp examples, OAuth 2.0 client credentials, timeouts.

Open the Java track

Python

requests examples, pagination helpers and webhook signature verification.

Open the Python track

.NET

HttpClient examples, typed models and resilient policies with Polly.

Open the .NET track

Getting ready to move with Europcar Mobility Group

Ten minutes to your first booking

The universal curl track below walks through credentials, tokens, your first Offers call and an optional Reservation. Every language track covers exactly the same flow, so your team can mix stacks with confidence.

The universal curl track

Five steps: create an app, get a token, call Offers, optionally create a Reservation, then verify in analytics.

1. Create an app and credentials

Go to Get Access, register or sign in, then open My Apps and choose New App.
Select the Sandbox environment and the APIs and scopes you need.
Copy your CLIENT_ID and CLIENT_SECRET.

2. Know your base URLs

Sandbox: <SANDBOX_BASE_URL>
Production: <PROD_BASE_URL>

Keep Production for later. Do all first tests in Sandbox.

3. Get an access token (OAuth 2.0 client credentials)

curl -X POST "$SANDBOX_AUTH_URL/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&scope=offers.read reservations.write"

Example response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "offers.read reservations.write"
}

4. Make your first call: Offers search

ACCESS_TOKEN="paste_token_here"

curl -X GET "$SANDBOX_BASE_URL/v1/offers/search?pickupStationId=FR-PAR-001&pickupDate=2025-10-01T09:00:00Z&returnDate=2025-10-03T09:00:00Z" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/json" \
  -H "x-correlation-id: quickstart-$(uuidgen)"

Trimmed response:

{
  "offers": [
    {
      "offerId": "off_123",
      "vehicle": { "category": "ECMN", "brand": "Peugeot", "model": "208" },
      "price": { "currency": "EUR", "total": 86.40 },
      "rate": { "ref": "NRF_BUNDLE_A", "refundable": false }
    }
  ]
}

5. Optional: create a reservation (idempotent POST)

curl -X POST "$SANDBOX_BASE_URL/v1/reservations" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "offerId": "off_123",
    "driver": { "firstName": "Ana", "lastName": "Martinez", "email": "ana@example.com" },
    "payment": { "mode": "PREPAID", "instrument": "TOKEN_abc" },
    "extras": [ { "code": "GPS" } ]
  }'

Tip: re-using the same Idempotency-Key safely retries a create without duplicates.

Verify and next steps

Check Workspace → Usage & Analytics, or your app's Analytics tab, to see your requests land. Explore Use Cases for end-to-end flows, or jump to the API Reference for exact contract details. Read Security & Compliance for scopes, rate limits and data handling.

What every language track covers

All tracks cover the same essentials, so teams can mix languages with confidence.

Auth and secrets

OAuth 2.0 client credentials flow
Token refresh and caching
Scopes and least privilege

HTTP resilience

Timeouts, retries, backoff
Idempotency on POST
Circuit-breaking hints

API patterns

Pagination and filtering
Error model and correlation IDs
Webhook signature verification

Common pitfalls and quick fixes

401 / 403: check the scopes selected when creating the app, and make sure you are using a Sandbox key against Sandbox.
Expired token: expires_in is usually around 3600 seconds. Cache the token and refresh before expiry.
429 rate limit: respect the Retry-After header and implement exponential backoff.
Clock skew: if you validate JWTs or use mTLS on your side, keep system time in sync with NTP.
CORS in browser apps: exchange tokens server-side. Never expose secrets in the browser.
POST retries: always send an Idempotency-Key for create and update operations.

Where to next?

Take your integration further

Go deeper with end-to-end flows, exact contracts and policy details.

Explore Use Cases Open API Reference