City, Gdynia Authentication: Methods and Best Practices (2026)

Authentication overview

Authentication for City, Gdynia's digital services and public APIs is designed to ensure secure and controlled access to municipal data and functionalities. This process verifies the identity of an application or user before authorizing requests, protecting sensitive information and maintaining the integrity of public services. The specific authentication method required depends on the service being accessed, ranging from simple API keys for public data retrieval to more robust OAuth 2.0 flows for services requiring user consent or access to personal data.

The City of Gdynia prioritizes secure data exchange, aligning its authentication mechanisms with industry standards. Developers interacting with City, Gdynia APIs should familiarize themselves with the available methods and implement them according to the provided documentation to ensure compliance and robust security for their applications. Access to developer resources and detailed guides can be found on the main City of Gdynia official website.

Supported authentication methods

City, Gdynia supports a range of authentication methods tailored to the sensitivity and nature of the data or service being accessed. The primary methods include API Keys for general data access and OAuth 2.0 for more secure, delegated access, especially when user-specific data is involved.

API Key authentication

API Key authentication is suitable for applications that need to access public or non-sensitive data, where the key identifies the calling application. This method is straightforward to implement and manage for services that do not require user-specific authorization.

• Mechanism: A unique alphanumeric string passed with each request.
• Usage: Typically included in the request header (e.g., X-API-Key) or as a query parameter (less secure).
• Best for: Accessing public datasets, general information retrieval, and services that do not involve user accounts.

OAuth 2.0 authentication

OAuth 2.0 is an authorization framework that enables an application to obtain limited access to a user's data on an HTTP service, without giving the application the user's credentials. This is crucial for citizen services where applications need to act on behalf of a user with their explicit consent.

• Mechanism: Involves an authorization server issuing access tokens to client applications after successful user authentication and consent.
• Flows supported: Authorization Code Grant is the recommended flow for web applications, while Implicit Grant or Client Credentials Grant might be used for specific scenarios. For a detailed explanation of OAuth 2.0 flows, refer to the OAuth 2.0 specification.
• Usage: Access tokens are typically sent in the Authorization header as a Bearer Token (e.g., Authorization: Bearer [access_token]).
• Best for: Services requiring user-specific data, delegated access, and integration with citizen portals where user consent is paramount.

Supported Authentication Methods Summary

Getting your credentials

The process for obtaining authentication credentials for City, Gdynia APIs varies depending on the chosen method and the specific service you intend to integrate with. Generally, access to credentials involves registration and approval through the city's developer portal or direct communication with the IT department.

For API Keys

1. Registration: Developers are typically required to register their application on the City, Gdynia developer portal (currently under development, information available via the main Gdynia website).
2. Application Details: Provide details about your application, its purpose, and the specific APIs you intend to consume.
3. Key Issuance: Upon review and approval, an API Key will be generated and provided to you, usually through the developer portal interface or via email.
4. Storage: Securely store your API Key. Treat it like a password and do not embed it directly into client-side code or public repositories.

For OAuth 2.0 Clients

1. Client Registration: Register your application as an OAuth 2.0 client on the City, Gdynia authorization server. This typically involves providing a client name, redirect URIs, and a description of your application.
2. Client ID and Secret: Upon registration, you will be issued a Client ID and a Client Secret. The Client ID is public, but the Client Secret must be kept confidential, similar to an API Key.
3. Scopes Request: Specify the necessary OAuth scopes your application requires to access specific user data or functionalities.
4. Callback URL Configuration: Ensure your application's callback or redirect URI is correctly configured in the authorization server to receive authorization codes or access tokens securely.

For the most up-to-date and specific instructions on credential acquisition, developers should consult the City, Gdynia's official documentation for developers, which provides detailed guides and registration forms.

Authenticated request example

Here are examples of how to make authenticated requests using both API Key and OAuth 2.0 (Bearer Token) methods.

API Key example

This example demonstrates how to include an API Key in the X-API-Key header for accessing a hypothetical public service endpoint.

curl -X GET \
  'https://api.gdynia.pl/v1/public-data/parks' \
  -H 'X-API-Key: YOUR_API_KEY_HERE'

Replace YOUR_API_KEY_HERE with your actual API Key obtained during the credential setup process.

OAuth 2.0 (Bearer Token) example

This example shows how to use an OAuth 2.0 access token in the Authorization header to access a user-specific service. Assume you have already completed the OAuth 2.0 flow and obtained an access_token.

curl -X GET \
  'https://api.gdynia.pl/v1/citizen-services/my-permits' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN_HERE'

Replace YOUR_ACCESS_TOKEN_HERE with the valid access token issued by the City, Gdynia authorization server. Access tokens typically have an expiration time, and your application will need to refresh them as needed, usually using a refresh token if granted.

Security best practices

Implementing secure authentication is critical for protecting both your application and City, Gdynia's services. Adhering to these best practices will help maintain the integrity and confidentiality of data.

• Protect your credentials:
  • API Keys and Client Secrets: Treat these as sensitive information. Do not embed them directly into client-side code (e.g., JavaScript). Store them securely in environment variables or a secrets management service on your server.
  • Version Control: Never commit API Keys or Client Secrets to public or private version control systems (e.g., Git repositories). Use .gitignore files or similar mechanisms to prevent accidental exposure.
• Use HTTPS/TLS: Always ensure all communication with City, Gdynia APIs occurs over HTTPS (HTTP Secure). This encrypts data in transit, protecting authentication credentials and data payloads from interception. Most modern API calls default to HTTPS, but explicit verification is essential. The Mozilla Developer Network provides an overview of TLS.
• Manage OAuth 2.0 tokens securely:
  • Access Tokens: These are short-lived. Do not store them persistently if not necessary. When stored, ensure they are protected against unauthorized access.
  • Refresh Tokens: These are long-lived and highly sensitive. Store refresh tokens with the highest level of security, typically in an encrypted database or secure token store. Use them only to obtain new access tokens and never expose them to client-side code.
  • Scope Management: Request only the minimum necessary OAuth scopes for your application's functionality. Over-requesting scopes increases the risk in case of a security breach.
• Validate redirect URIs: For OAuth 2.0, ensure that the redirect URIs registered with City, Gdynia's authorization server are specific and secure. Only allow redirection to URLs that your application explicitly controls to prevent authorization code interception.
• Implement rate limiting and error handling: While not strictly an authentication mechanism, proper rate limiting and robust error handling on your application's side can mitigate brute-force attacks and prevent denial-of-service attempts against City, Gdynia's services.
• Regularly rotate credentials: Periodically rotate your API Keys and OAuth Client Secrets, especially if there's any suspicion of compromise. City, Gdynia's developer portal should provide mechanisms for this.
• Monitor for suspicious activity: Implement logging and monitoring within your application to detect and alert on unusual authentication attempts or API usage patterns that could indicate a security incident.