---
title: "Quickstarts"
description: "Generate credentials, make your first call, and move from Sandbox to Production with confidence."
url: "https://developers.europcar-mobility-group.com/quickstarts"
image: "https://developers.europcar-mobility-group.com/_og/d/c_Ocean.takumi,title_Quickstarts,description_~R2VuZXJhdGUgY3JlZGVudGlhbHMsIG1ha2UgeW91ciBmaXJzdCBjYWxsLCBhbmQgbW92ZSBmcm9tIFNhbmRib3ggdG8gUHJvZHVjdGlvbiB3aXRoIGNvbmZpZGVuY2Uu,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMyRjMzMkYifX19,p_Ii9xdWlja3N0YXJ0cyI,s_iC9WSvcvIZZ4Ewbq.png"
---

Start building

# New here? Start with Quickstarts

Generate credentials, make your first call, and subscribe to status updates. You can always return to this hub to find the next section you need.

[Get credentials](https://developers.europcar-mobility-group.com/get-access)[Browse APIs](https://developers.europcar-mobility-group.com/api-catalog)

---

## Choose your language

Pick a language-specific track, or follow the universal **curl** quickstart below.

### [JavaScript / TypeScript](#javascript-typescript)

Node.js with `fetch` or `axios`, token caching, retries and idempotency helpers.

[Open the JS/TS track](https://developers.europcar-mobility-group.com/quickstarts/javascript)

### [Java](#java)

Java 17+, `HttpClient` and OkHttp examples, OAuth 2.0 client credentials, timeouts.

[Open the Java track](https://developers.europcar-mobility-group.com/quickstarts/java)

### [Python](#python)

`requests` examples, pagination helpers and webhook signature verification.

[Open the Python track](https://developers.europcar-mobility-group.com/quickstarts/python)

### [.NET](#net)

`HttpClient` examples, typed models and resilient policies with Polly.

[Open the .NET track](https://developers.europcar-mobility-group.com/quickstarts/dotnet)

![Getting ready to move with Europcar Mobility Group](https://emobg-devportal-images.s3.eu-west-3.amazonaws.com/packing-on-emobg.jpg)

## Ten minutes to your first booking

The universal curl track below walks through credentials, tokens, your first **Offers** call and an optional **Reservation**. Every language track covers exactly the same flow, so your team can mix stacks with confidence.

## [The universal curl track](#the-universal-curl-track)

Five steps: create an app, get a token, call **Offers**, optionally create a **Reservation**, then verify in analytics.

### [1\. Create an app and credentials](#_1-create-an-app-and-credentials)

-   Go to **Get Access**, register or sign in, then open **My Apps** and choose **New App**.
-   Select the **Sandbox** environment and the APIs and scopes you need.
-   Copy your `CLIENT_ID` and `CLIENT_SECRET`.

### [2\. Know your base URLs](#_2-know-your-base-urls)

-   **Sandbox:** `<SANDBOX_BASE_URL>`
-   **Production:** `<PROD_BASE_URL>`

Keep Production for later. Do all first tests in Sandbox.

### [3\. Get an access token (OAuth 2.0 client credentials)](#_3-get-an-access-token-oauth-20-client-credentials)

```bash
curl -X POST "$SANDBOX_AUTH_URL/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&scope=offers.read reservations.write"
```

Example response:

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "offers.read reservations.write"
}
```

### [4\. Make your first call: Offers search](#_4-make-your-first-call-offers-search)

```bash
ACCESS_TOKEN="paste_token_here"

curl -X GET "$SANDBOX_BASE_URL/v1/offers/search?pickupStationId=FR-PAR-001&pickupDate=2025-10-01T09:00:00Z&returnDate=2025-10-03T09:00:00Z" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/json" \
  -H "x-correlation-id: quickstart-$(uuidgen)"
```

Trimmed response:

```json
{
  "offers": [
    {
      "offerId": "off_123",
      "vehicle": { "category": "ECMN", "brand": "Peugeot", "model": "208" },
      "price": { "currency": "EUR", "total": 86.40 },
      "rate": { "ref": "NRF_BUNDLE_A", "refundable": false }
    }
  ]
}
```

### [5\. Optional: create a reservation (idempotent POST)](#_5-optional-create-a-reservation-idempotent-post)

```bash
curl -X POST "$SANDBOX_BASE_URL/v1/reservations" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "offerId": "off_123",
    "driver": { "firstName": "Ana", "lastName": "Martinez", "email": "ana@example.com" },
    "payment": { "mode": "PREPAID", "instrument": "TOKEN_abc" },
    "extras": [ { "code": "GPS" } ]
  }'
```

**Tip:** re-using the same `Idempotency-Key` safely retries a create without duplicates.

## [Verify and next steps](#verify-and-next-steps)

Check **Workspace → Usage & Analytics**, or your app's [Analytics tab](https://developers.europcar-mobility-group.com/analytics), to see your requests land. Explore [Use Cases](https://developers.europcar-mobility-group.com/use-cases) for end-to-end flows, or jump to the [API Reference](https://developers.europcar-mobility-group.com/api-catalog) for exact contract details. Read Security & Compliance for scopes, rate limits and data handling.

## What every language track covers

All tracks cover the same essentials, so teams can mix languages with confidence.

### [Auth and secrets](#auth-and-secrets)

-   OAuth 2.0 client credentials flow
-   Token refresh and caching
-   Scopes and least privilege

### [HTTP resilience](#http-resilience)

-   Timeouts, retries, backoff
-   Idempotency on POST
-   Circuit-breaking hints

### [API patterns](#api-patterns)

-   Pagination and filtering
-   Error model and correlation IDs
-   Webhook signature verification

### [Common pitfalls and quick fixes](#common-pitfalls-and-quick-fixes)

-   **401 / 403:** check the scopes selected when creating the app, and make sure you are using a Sandbox key against Sandbox.
-   **Expired token:** `expires_in` is usually around 3600 seconds. Cache the token and refresh before expiry.
-   **429 rate limit:** respect the `Retry-After` header and implement exponential backoff.
-   **Clock skew:** if you validate JWTs or use mTLS on your side, keep system time in sync with NTP.
-   **CORS in browser apps:** exchange tokens server-side. Never expose secrets in the browser.
-   **POST retries:** always send an `Idempotency-Key` for create and update operations.

Where to next?

## [Take your integration further](#take-your-integration-further)

Go deeper with end-to-end flows, exact contracts and policy details.

[Explore Use Cases](https://developers.europcar-mobility-group.com/use-cases)[Open API Reference](https://developers.europcar-mobility-group.com/api-catalog)