bng2latlong Authentication: API Key Setup & Best Practices (2026)

Authentication overview

The bng2latlong API secures access to its UK-focused geocoding and British National Grid (BNG) conversion services primarily through the use of API keys. This method provides a direct and manageable way for developers to authenticate their applications when making requests. An API key acts as a unique identifier for a user or application, allowing the bng2latlong system to verify the legitimacy of incoming requests and enforce usage limits associated with the account. Each request made to the bng2latlong API must include a valid API key to receive a successful response.

The API key mechanism is a common authentication pattern for web services, offering a balance between ease of implementation and security, especially when combined with secure transport protocols like HTTPS (Hypertext Transfer Protocol Secure). By requiring an API key with every request, bng2latlong can track usage, prevent unauthorized access, and manage rate limits to ensure fair usage and service stability across all users. Developers should safeguard their API keys to prevent unauthorized use, as a compromised key could lead to service interruptions or unexpected billing.

For detailed information on specific API endpoints and their requirements, refer to the bng2latlong API documentation.

Supported authentication methods

bng2latlong's API relies on a single, consistent authentication method across its various endpoints: API Key authentication. This method is suitable for server-side applications, client-side applications where keys can be managed securely, and development environments requiring quick integration.

API Key (Query Parameter)

With this method, your unique API key is passed as a query parameter in the URL of each API request. The bng2latlong system then validates this key against its records to authenticate the request. This approach is straightforward to implement across various programming languages and environments. While convenient, it necessitates careful handling of the key to prevent exposure, especially in client-side applications where the URL might be visible.

The API key typically identifies your account and subscription level, determining your access rights and rate limits. For example, the free tier allows up to 500 requests per day, which is enforced via the API key.

Getting your credentials

Accessing the bng2latlong API requires a valid API key, which you obtain by registering for an account on the bng2latlong website. The process is designed to be self-service and provides immediate access to your credentials.

Steps to obtain your API key:

1. Visit the bng2latlong website: Navigate to the official bng2latlong homepage.
2. Sign Up/Register: Look for a 'Sign Up' or 'Register' option. You will typically need to provide an email address and create a password.
3. Account Activation: Follow any instructions to activate your account, which may involve verifying your email address through a link sent to your inbox.
4. Access the Dashboard: Once logged in, you should be directed to your user dashboard or a similar account management page.
5. Locate your API Key: Within the dashboard, there will be a section dedicated to API keys or developer settings. Your unique API key will be displayed here. It is often a long string of alphanumeric characters.
6. Copy your API Key: Copy the API key and store it securely. You will need this key for every API request you make.

bng2latlong typically provides a single primary API key per account. If you anticipate needing multiple keys for different applications or environments (e.g., development, staging, production), consult the bng2latlong API documentation for guidance on managing multiple keys or discuss options with their support.

Authenticated request example

To demonstrate how to include your API key in an API request, here are examples using cURL and JavaScript, two of the languages supported with code examples in the bng2latlong documentation. For these examples, replace YOUR_API_KEY with the actual API key obtained from your bng2latlong dashboard and YOUR_POSTCODE with a valid UK postcode.

cURL Example

This cURL command makes a request to convert a UK postcode to latitude and longitude, including the API key as a query parameter.

curl "https://www.bng2latlong.co.uk/api/postcode/?postcode=YOUR_POSTCODE&key=YOUR_API_KEY"

JavaScript Example (Fetch API)

This JavaScript code snippet uses the fetch API to perform the same postcode conversion, demonstrating how to construct the URL with the API key.

const apiKey = 'YOUR_API_KEY';
const postcode = 'YOUR_POSTCODE'; // e.g., 'SW1A 0AA'

async function getCoordinates(postcode, key) {
  try {
    const response = await fetch(`https://www.bng2latlong.co.uk/api/postcode/?postcode=${postcode}&key=${key}`);
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    const data = await response.json();
    console.log('Latitude:', data.latitude);
    console.log('Longitude:', data.longitude);
    return data;
  } catch (error) {
    console.error('Error fetching coordinates:', error);
  }
}

getCoordinates(postcode, apiKey);

These examples illustrate the fundamental principle: append ?key=YOUR_API_KEY to the endpoint URL to authenticate your request. Always ensure that the API key is correctly formatted and included. Incorrect or missing keys will result in authentication failures, typically returning an HTTP 401 Unauthorized or similar error.

Security best practices

Securing your API keys is crucial to prevent unauthorized access, manage usage costs, and maintain the integrity of your applications. While bng2latlong uses API keys, implementing robust security practices around their use is your responsibility. The following best practices are generally applicable for API key management and contribute to the overall security of your integration.

1. Keep API Keys Confidential

• Never hardcode keys in client-side code: For web applications running in a browser or mobile apps, embedding API keys directly can expose them to public view. Instead, use a backend proxy to make API calls or store keys in secure environment variables.
• Use environment variables: When deploying server-side applications, store API keys as environment variables rather than directly in your codebase. This prevents them from being committed to version control systems like Git.
• Restrict access to source code: Ensure that only authorized personnel have access to repositories containing code that uses API keys.

2. Transmit Keys Securely (HTTPS)

• Always use HTTPS: The bng2latlong API, like all modern APIs, should only be accessed over HTTPS. This encrypts the communication channel between your application and the API server, protecting your API key and data from eavesdropping during transit. The IETF's RFC 2818 defines the use of HTTPS for secure communication over the internet.
• Verify SSL/TLS certificates: Ensure your application is configured to verify the SSL/TLS certificate of the bng2latlong endpoint. This prevents man-in-the-middle attacks where an attacker might try to impersonate the API server.

3. Implement Rate Limiting and Monitoring

• Monitor API usage: Regularly check your bng2latlong account dashboard for unusual spikes in API calls. This can indicate a compromised key or an unintended usage pattern.
• Implement client-side rate limits: If possible, implement rate limiting in your application to prevent excessive calls, which can help mitigate the impact of a compromised key or a bug in your code.

4. Key Rotation and Revocation

• Periodically rotate keys: If bng2latlong provides a mechanism to rotate API keys (generate a new one and invalidate the old), do so regularly, such as every 90 days. This limits the window of exposure for a compromised key.
• Revoke compromised keys immediately: If you suspect an API key has been compromised, revoke it immediately through your bng2latlong account dashboard and generate a new one.

5. Principle of Least Privilege

• Use dedicated keys for different applications: If bng2latlong supports multiple API keys, generate separate keys for different applications or services. This allows you to revoke access for one service without affecting others if a key is compromised.
• Request only necessary permissions: While bng2latlong's API keys typically grant access to all available endpoints, adhering to the principle of least privilege generally means only granting necessary permissions if an API offers granular access controls.

By following these best practices, you can significantly enhance the security posture of your integrations with the bng2latlong API and safeguard your data and account.