BdAPIs Authentication: API Key Setup and Security (2026)

Authentication overview

BdAPIs secures access to its Geocoding, Reverse Geocoding, and Address Autocomplete APIs primarily through API key authentication. An API key is a unique token that identifies an application or user when making requests to the BdAPIs platform. This key is provisioned through the user's account dashboard and must be included with every API request to successfully access BdAPIs services. The use of API keys helps BdAPIs manage usage quotas for both free and paid tiers, and ensures that only authorized applications consume API resources.

The authentication process ensures that requests are traceable and that usage limits, such as the BdAPIs free tier of 5,000 requests per month, are enforced correctly. All API communication with BdAPIs is expected to occur over HTTPS/TLS to encrypt data in transit and protect API keys from interception. This is a standard security practice for web APIs to prevent unauthorized access and data tampering, as outlined by general recommendations for secure web contexts.

Supported authentication methods

BdAPIs supports a single, streamlined authentication method for its API endpoints: API Key authentication. This method is suitable for most application types, from server-side integrations to client-side JavaScript applications, provided appropriate security measures are in place.

While API keys offer a straightforward authentication mechanism, developers are responsible for implementing best practices to protect their keys from unauthorized use. This includes restricting API key access, using environment variables for server-side applications, and implementing IP address restrictions where possible. For client-side applications, a backend proxy is often recommended to prevent direct exposure of the API key to end-users.

Getting your credentials

To access the BdAPIs platform, you must first obtain an API key. This key serves as your primary credential for authenticating all requests to the BdAPIs Geocoding, Reverse Geocoding, and Address Autocomplete APIs. The process for generating and managing your API key is initiated through the BdAPIs account dashboard.

1. Create a BdAPIs Account: If you do not already have an account, navigate to the BdAPIs homepage and complete the registration process. This typically involves providing an email address and creating a password.
2. Access the Dashboard: Once registered and logged in, you will be directed to your personal BdAPIs dashboard. This is the central hub for managing your API keys, monitoring usage, and accessing documentation.
3. Generate an API Key: Within the dashboard, locate the section dedicated to API Keys or Credentials. There will typically be an option to generate a new API key. Follow the prompts to create your key. Some platforms may allow you to name your key for easier identification or associate it with specific projects.
4. Copy Your API Key: After generation, your unique API key will be displayed. It is crucial to copy this key immediately and store it securely. BdAPIs may only show the full key once for security reasons. If you lose your key, you might need to generate a new one and update your applications accordingly.
5. Configure Security Settings (Optional but Recommended): Depending on BdAPIs's features, you might be able to add restrictions to your API key, such as limiting its use to specific IP addresses or HTTP referrers. These restrictions enhance security by preventing unauthorized use if your key is exposed. Refer to the official BdAPIs documentation for detailed instructions on applying these restrictions.

Remember that your API key is a sensitive credential. Treat it with the same level of confidentiality as you would a password. Never embed it directly into publicly accessible client-side code without a proxy, and avoid committing it to version control systems.

Authenticated request example

Once you have obtained your API key, you can integrate it into your API requests. BdAPIs expects the API key to be passed as a query parameter in the URL. Below are examples demonstrating how to make an authenticated request using popular programming languages. For these examples, replace YOUR_API_KEY with your actual BdAPIs API key and adjust the endpoint and parameters as needed for the specific API you are calling (e.g., Geocoding, Reverse Geocoding).

JavaScript (using Fetch API)

const apiKey = 'YOUR_API_KEY';
const address = '1600 Amphitheatre Parkway, Mountain View, CA';
const endpoint = `https://api.bdapis.com/geocode?address=${encodeURIComponent(address)}&apiKey=${apiKey}`;

fetch(endpoint)
  .then(response => {
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    return response.json();
  })
  .then(data => {
    console.log(data);
  })
  .catch(error => {
    console.error('Error fetching geocoding data:', error);
  });

Python (using requests library)

import requests
import os

# It's recommended to store API keys in environment variables
api_key = os.environ.get('BDAPIS_API_KEY', 'YOUR_API_KEY') # Fallback for testing
address = '1600 Amphitheatre Parkway, Mountain View, CA'

params = {
    'address': address,
    'apiKey': api_key
}

response = requests.get('https://api.bdapis.com/geocode', params=params)

if response.status_code == 200:
    print(response.json())
else:
    print(f"Error: {response.status_code} - {response.text}")

PHP (using cURL)

<?php
$apiKey = 'YOUR_API_KEY';
$address = urlencode('1600 Amphitheatre Parkway, Mountain View, CA');
$url = "https://api.bdapis.com/geocode?address={$address}&apiKey={$apiKey}";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($httpCode == 200) {
    echo $response;
} else {
    echo "Error: " . $httpCode . " - " . $response;
}
?>

These examples illustrate the fundamental approach to including your API key in BdAPIs requests. Always refer to the specific BdAPIs API reference for the exact endpoint paths and required parameters for each service.

Security best practices

Securing your API keys is crucial to prevent unauthorized access to your BdAPIs account, protect your usage quotas, and safeguard your data. Adhering to these best practices will help maintain the integrity and security of your integrations.

• Keep API Keys Confidential: Treat your API key as a sensitive credential, similar to a password. Never embed it directly into client-side code that is publicly accessible (e.g., JavaScript in a static HTML page) without a secure proxy. If a client-side application requires access, route requests through your own backend server that appends the API key securely.
• Use Environment Variables for Server-Side Applications: For applications running on a server, store your API key in environment variables rather than hardcoding it directly into your source code. This prevents the key from being exposed if your code repository is compromised. Most programming languages and deployment platforms provide mechanisms for managing environment variables.
• Implement IP Address Restrictions: If BdAPIs supports it, configure your API key to only accept requests originating from a specific set of IP addresses. This is highly effective for server-side applications where the server's IP address is static and known. This restriction prevents unauthorized use even if the key is stolen, as requests from other IP addresses will be rejected.
• Use HTTP Referrer Restrictions: For web applications, configure your API key to only accept requests originating from specific HTTP referrers (your domain names). This helps prevent the key from being used on other websites if it's unintentionally exposed in client-side code.
• Rotate API Keys Regularly: Periodically generate new API keys and replace the old ones in your applications. This practice, known as key rotation, reduces the window of opportunity for a compromised key to be exploited. The recommended frequency for rotation can vary based on your security policies and risk assessment.
• Monitor API Usage: Regularly review your API usage statistics in the BdAPIs dashboard. Unusual spikes in usage could indicate a compromised API key or an issue with your application, prompting immediate investigation.
• Use HTTPS/TLS: Always ensure that all communication with the BdAPIs API occurs over HTTPS (TLS). This encrypts the data in transit, including your API key, protecting it from eavesdropping and man-in-the-middle attacks. BdAPIs endpoints are expected to enforce HTTPS by default.
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures. Avoid exposing sensitive information (like the API key) in error messages that might be displayed to end-users or logged insecurely.