I am trying to retrieve fares between two different cities on a travel website. In the request headers, I see the following.
'x-api-idtoken':'null',
'x-api-key':'l7xx944d175ea25f4b9c903a583ea82a1c4c',
Do they change/expire with time?
They could change over time and in many cases do. Access keys/tokens can be given a limited life span, but it is up to the service in question to control refresh, expiration and/or revocation.
Given that the question does not contain an explicit reference to the web service involved, it is not possible to answer specifically for this case. Typically, the access management scheme is documented as part of the API.
x-api-key in request headers