Charity Search Authentication: API Key Setup & Security (2026)

Authentication overview

Charity Search utilizes API keys as its primary method for authenticating requests to the Charity Search API. This approach provides a straightforward mechanism for developers to prove their identity and authorize their application's access to the platform's extensive charity data. Each API key is unique to a user account and is generated through the Charity Search account dashboard. When making an API call, this key must be included in the request, typically within a header or as a query parameter, to ensure that the request originates from an authorized source and to enforce rate limits associated with the user's plan.

The API key system is designed to be simple to implement, allowing developers to quickly integrate charity data into their applications for purposes such as non-profit discovery, due diligence, and research into charitable organizations. Charity Search's API documentation provides detailed instructions on how to set up and use these keys effectively, including interactive examples for common use cases, which aids in a smooth developer experience. The system's design ensures that API keys are the sole credential required for accessing the Charity Search API, simplifying the authentication flow without requiring complex token exchange or session management.

Supported authentication methods

Charity Search primarily supports API key authentication. This method is common for web APIs that need to identify the calling application and manage access based on usage tiers or subscription plans. API keys serve as a token that applications provide when making requests to the Charity Search API, allowing the service to verify the caller's identity and determine their access privileges.

While API keys are effective for client-server authentication, they differ from more complex authentication flows like OAuth 2.0, which is typically used for delegated authorization (e.g., a user granting a third-party application access to their data on another service without sharing their credentials). For Charity Search, the focus is on direct application access to its own data, making API keys a suitable and efficient choice. The platform does not currently offer support for OAuth 2.0 or other token-based authentication mechanisms for direct API access.

The following table outlines the supported authentication method:

Getting your credentials

To obtain your API key for Charity Search, you must first register for an account on the Charity Search platform. Upon successful registration and login, your API key will be available in your personal account dashboard. This key acts as your unique identifier and authenticator for all API requests. The process typically involves these steps:

1. Sign Up/Log In: Navigate to the Charity Search homepage and either create a new account or log in to an existing one.
2. Access Dashboard: Once logged in, locate the section of your dashboard dedicated to API access or developer settings. The exact navigation may vary but is usually labeled intuitively, such as "API Keys" or "Developer Settings".
3. Generate/Retrieve Key: Your API key will typically be displayed there. If it's your first time, you might need to click a button to "Generate New Key". For existing users, the key might already be visible.
4. Copy Key: Carefully copy the generated API key. It is a long string of alphanumeric characters.

Charity Search offers a Developer Plan, which includes 500 free requests per month, allowing users to test the API and understand its functionality before committing to a paid plan. Your API key will work across all plans, with access and rate limits determined by your active subscription.

It is crucial to treat your API key as a sensitive credential. Losing control of your API key could result in unauthorized access to your account's API usage, potentially incurring unexpected charges or exceeding your rate limits. For more detailed instructions, refer to the official Charity Search API documentation.

Authenticated request example

Once you have obtained your API key, you can include it in your API requests. Charity Search expects the API key to be passed as a query parameter named api_key in your request URL. Here's an example using cURL, Python, and Node.js to fetch data for a specific charity:

cURL Example

This cURL command demonstrates how to make a GET request to the Charity Search API, including your API key as a query parameter:

curl -X GET "https://api.charitysearch.org/v1/charities/123456789?api_key=YOUR_API_KEY" \
     -H "Accept: application/json"

Replace YOUR_API_KEY with your actual API key and 123456789 with the desired charity ID.

Python Example

Using the requests library in Python, you can construct a similar authenticated request:

import requests

API_KEY = "YOUR_API_KEY"  # Replace with your actual API key
CHARITY_ID = "123456789" # Replace with the desired charity ID

url = f"https://api.charitysearch.org/v1/charities/{CHARITY_ID}"
params = {
    "api_key": API_KEY
}
headers = {
    "Accept": "application/json"
}

response = requests.get(url, params=params, headers=headers)

if response.status_code == 200:
    print(response.json())
else:
    print(f"Error: {response.status_code} - {response.text}")

Node.js Example

Here's an example using Node.js with the built-in https module or a library like axios:

const axios = require('axios');

const API_KEY = "YOUR_API_KEY"; // Replace with your actual API key
const CHARITY_ID = "123456789"; // Replace with the desired charity ID

async function getCharityData() {
  try {
    const response = await axios.get(`https://api.charitysearch.org/v1/charities/${CHARITY_ID}`, {
      params: {
        api_key: API_KEY
      },
      headers: {
        'Accept': 'application/json'
      }
    });
    console.log(response.data);
  } catch (error) {
    console.error(`Error: ${error.response.status} - ${error.response.data}`);
  }
}

getCharityData();

These examples illustrate the fundamental way to authenticate your requests by including the api_key query parameter. Always ensure your API key is correctly formatted and included in every request to avoid authentication errors.

Security best practices

Securing your Charity Search API key is critical to prevent unauthorized access to your account and to protect your application's integrity. Adhering to these best practices will help maintain the confidentiality and security of your credentials:

• Never expose your API key publicly: Do not embed your API key directly in client-side code (e.g., JavaScript in a browser) or commit it to public version control systems like GitHub. If your application needs to access the Charity Search API from a client-side environment, consider routing requests through a secure backend server that can manage and proxy the API key securely. The Google Maps Platform API key best practices offer general guidance applicable to managing any API key securely.

• Use environment variables for server-side applications: For server-side applications, store your API key in environment variables rather than hardcoding it directly into your source code. This practice prevents the key from being accidentally committed to version control and makes it easier to manage different keys across development, staging, and production environments.

• Restrict API key usage (if available): While Charity Search API keys are generally tied to your account for overall usage, if there were ever options to restrict an API key by IP address or HTTP referrer, you would use them. Always check the Charity Search API documentation for any available mechanisms to further restrict API key usage.

• Regularly rotate API keys: Periodically generating a new API key and revoking the old one adds an extra layer of security. This practice minimizes the risk if an old key is compromised without your knowledge. Check your Charity Search dashboard for options to regenerate your API key.

• Monitor API usage: Keep an eye on your API usage statistics within your Charity Search account dashboard. Unusual spikes in usage could indicate that your API key has been compromised. Promptly investigate any suspicious activity.

• Implement proper error handling: Ensure your application gracefully handles authentication failures. Do not expose sensitive error messages that might reveal information about your API key or internal system configuration to end-users.

• Secure your development environment: Ensure that your development machines and build processes are secure. Malicious software or insecure configurations can expose API keys during development or deployment.