Bing Maps Authentication: API Key Setup & Security (2026)

Authentication overview

Authentication for Bing Maps services verifies the identity of applications making requests, ensuring that usage is authorized and properly attributed to a developer's account. This process is fundamental for monitoring API consumption, applying usage limits, and securing access to various Bing Maps features, which span from geocoding and routing to interactive map displays. Without proper authentication, requests to the Bing Maps API will typically result in error responses, preventing access to geospatial data and functionality. The primary mechanism for authentication across Bing Maps's offerings is the API key, a unique identifier that developers generate and manage through the Bing Maps Dev Center.

The API key acts as a credential, enabling the Bing Maps platform to identify the calling application and associate its usage with a specific subscription. This model simplifies integration for developers, as the same key can often be used across different Bing Maps services, including the Bing Maps REST Services and client-side SDKs like the Bing Maps V8 Web Control. While straightforward, securing these API keys is critical to prevent unauthorized use and potential billing issues. The platform provides mechanisms for restricting key usage, such as specifying allowed referrers or IP addresses, to enhance security.

Supported authentication methods

Bing Maps primarily supports API key authentication for accessing its various services. This method is consistent across its REST APIs, JavaScript V8 Web Control, and mobile SDKs for iOS and Android. The API key serves as a unique token that identifies your application and authorizes its requests against your Bing Maps account.

The following table outlines when to use each method and its general security level:

While API keys are the standard, developers are encouraged to implement additional security measures, such as referrer restrictions for web applications and IP address restrictions for server-side calls, to mitigate risks associated with key exposure. This approach aligns with general API security practices for public-facing services, as highlighted in broader discussions on cloud service authentication best practices.

Getting your credentials

To obtain a Bing Maps API key, you must register an account and generate a key through the Bing Maps Dev Center. The process involves a few steps to ensure your key is correctly configured for your application's needs.

1. Create or Access Your Microsoft Account: You will need a Microsoft account to sign in to the Bing Maps Dev Center. If you do not have one, you can create one during this step.
2. Navigate to the Bing Maps Dev Center: Visit the official Bing Maps Dev Center website.
3. Sign In: Use your Microsoft account credentials to sign in.
4. Go to 'My Keys': Once logged in, locate the 'My Keys' section in the dashboard. This is where you manage all your existing API keys and generate new ones.
5. Create a New Key: Click on the 'Create a new key' button. You will be prompted to provide some details for your new key:
   • Application Name: A descriptive name for your application (e.g., "My Web Mapping App").
   • Application URL: The URL of your website or application (optional but recommended for web applications to enable referrer restrictions).
   • Key Type: Select the appropriate key type based on your usage (e.g., Basic, Enterprise).
   • Application Type: Choose the type of application you are developing (e.g., Website, Windows App, iOS App, Android App, or Universal Windows Platform). This helps Bing Maps understand how the key will be used and apply relevant security configurations.
6. Generate Key: After filling in the required information, click the 'Create' button. Your new API key will be generated and displayed.
7. Copy and Secure Your Key: Copy the generated API key immediately. Treat this key as sensitive information. It is crucial to store it securely and avoid embedding it directly into publicly accessible client-side code without additional restrictions.

You can also edit existing keys in the Dev Center to add referrer URL restrictions or IP address restrictions, which significantly enhance the security of your API key by limiting where it can be used. Regular review of your generated keys and their usage is a recommended practice to maintain application security and compliance.

Authenticated request example

Authenticating requests to Bing Maps typically involves appending your API key as a query parameter. The parameter name is usually key or bingmapskey, depending on the specific service or SDK being used. Below are examples for the Bing Maps REST Services and the Bing Maps V8 Web Control.

Bing Maps REST Services (Geocoding API)

For REST API calls, the key is included as a query string parameter. This example demonstrates a geocoding request to find coordinates for an address:

GET https://dev.virtualearth.net/REST/v1/Locations?query=1600%20Amphitheatre%20Parkway%2C%20Mountain%20View%2C%20CA&key=YOUR_BING_MAPS_API_KEY HTTP/1.1
Host: dev.virtualearth.net

In this example, YOUR_BING_MAPS_API_KEY should be replaced with the actual key you obtained from the Bing Maps Dev Center. The key parameter explicitly identifies your application for billing and access control.

Bing Maps V8 Web Control (JavaScript)

When using the Bing Maps V8 Web Control, your API key is configured during the script loading process or when initializing the map. This ensures all subsequent map interactions and data requests are authenticated.

<!DOCTYPE html>
<html>
<head>
    <title>Bing Maps V8 Authentication Example</title>
    <meta charset='utf-8' />
    <script type='text/javascript'>
        var map;
        function GetMap() {
            map = new Microsoft.Maps.Map(document.getElementById('myMap'), {
                credentials: 'YOUR_BING_MAPS_API_KEY'
            });
        }
    </script>
    <script type='text/javascript' src='https://www.bing.com/api/maps/mapcontrol?callback=GetMap&key=YOUR_BING_MAPS_API_KEY'></script>
</head>
<body>
    <div id="myMap" style="position:relative;width:600px;height:400px;"></div>
</body>
</html>

In this JavaScript example, the API key is provided in two places: as part of the src attribute for the map control script (&key=YOUR_BING_MAPS_API_KEY) and within the credentials option when initializing the Microsoft.Maps.Map object. Both are crucial for ensuring the map loads and functions correctly with proper authentication.

Security best practices

To prevent unauthorized usage and potential billing discrepancies, it is essential to implement robust security measures for your Bing Maps API keys. Adhering to these best practices will help protect your application and ensure the integrity of your mapping services.

• Restrict API Key Usage with Referrers or IP Addresses: This is the most critical security measure. In the Bing Maps Dev Center, you can specify a list of HTTP referrers (for web applications) or IP addresses (for server-side applications) that are authorized to use a specific API key. Any request originating from an unapproved referrer or IP address will be rejected. For web applications, configure this to match the domains where your application is hosted, such as *.example.com/*. For server-side applications, use the static IP address of your server.
• Do Not Embed Keys Directly in Public Client-Side Code: While the Bing Maps V8 Web Control requires the key to be accessible client-side, direct embedding without referrer restrictions is risky. Always configure referrer restrictions for client-side keys. For server-side keys, never expose them in client-side code.
• Use Environment Variables or Configuration Management: For server-side applications, store API keys in environment variables or a secure configuration management system rather than hardcoding them directly into the codebase. This practice ensures keys are not exposed in source control and are easier to manage and rotate.
• Implement Server-Side Proxies for Sensitive Operations: For operations that require higher security or involve sensitive data, consider routing requests through a server-side proxy. Your client-side application requests your server, which then makes the authenticated call to the Bing Maps API using a securely stored key. This prevents direct client exposure of the key, especially for operations like geocoding user-entered private addresses.
• Regularly Review and Rotate API Keys: Periodically review the usage of your API keys in the Bing Maps Dev Center. If any key shows unusual activity or if an employee with access leaves your organization, rotate the key by generating a new one and updating your applications. Delete any keys that are no longer in use.
• Monitor Usage and Set Alerts: Utilize the monitoring features within the Bing Maps Dev Center to track your API consumption. Set up alerts for unexpected spikes in usage, which could indicate unauthorized access or a misconfigured application. Proactive monitoring helps identify and mitigate potential security breaches quickly.
• Follow Principle of Least Privilege: If Bing Maps eventually introduces more granular access controls (e.g., specific permissions for geocoding vs. routing), use keys with the minimum necessary permissions for each application. Although Bing Maps primarily uses a single key type, applying this principle where possible is a good general security practice consistent with Microsoft Azure security best practices.