Covid-19 Authentication: A Developer's Guide (2026)

Authentication overview

Authentication for Covid-19 APIs is designed to secure access to epidemiological data, testing results, and vaccine administration records. It ensures that only authorized applications and users can retrieve or submit information, maintaining data integrity and patient privacy. The platform employs industry-standard authentication mechanisms to verify client identities before permitting interaction with its endpoints. This process is critical for preventing unauthorized data access and maintaining compliance with health data regulations. Developers should integrate authentication into their applications by obtaining appropriate credentials and adhering to specified security protocols. All communication with Covid-19 API endpoints must occur over HTTPS to encrypt data in transit, protecting against eavesdropping and tampering, as emphasized in general API security practices discussed by Cloudflare's API security considerations.

Supported authentication methods

The Covid-19 API primarily supports two authentication methods, each suited for different integration scenarios:

1. API Key Authentication: This is the most straightforward method for server-to-server communication or when an application needs direct access to public or unprivileged data on behalf of itself. An API key is a unique string that identifies the calling application. It is typically passed in the request header or as a query parameter. While simple, API keys require careful management to prevent unauthorized usage, as they grant access directly to the associated permissions.
2. OAuth 2.0: For applications that need to access Covid-19 data on behalf of an end-user, OAuth 2.0 is the recommended protocol. This method allows users to grant third-party applications limited access to their resources without sharing their credentials directly with the application. OAuth 2.0 involves a client application, an authorization server, a resource server (the Covid-19 API), and the resource owner (the end-user). It's suitable for scenarios such as patient portals displaying personal test results or vaccine records, where user consent is paramount. General principles for secure OAuth 2.0 implementations are outlined by OAuth.net.

Authentication Method Comparison

The following table summarizes the key characteristics of the supported authentication methods:

Getting your credentials

Accessing the Covid-19 API requires obtaining the correct credentials. The process typically begins in the Developer Dashboard.

1. Register for a Developer Account: Navigate to the Covid-19 Developer Portal and complete the registration process. This usually involves providing basic contact information and agreeing to the terms of service.
2. Create an Application: Once logged in, you will need to create a new application within your dashboard. This step is crucial as it links your requested credentials to a specific project or service.
3. Generate API Keys: For API Key authentication, the dashboard will provide an option to generate new API keys for your application. Each key is unique and should be treated as a secret. You may also have options to configure key permissions or scopes depending on the specific API endpoints you intend to access. The dashboard will typically display the key only once upon generation, so it is important to copy and store it securely immediately.
4. Configure OAuth 2.0 Clients: If your application requires OAuth 2.0, you will configure an OAuth client within your application settings in the developer dashboard. This involves specifying redirect URIs (callback URLs) and generating a Client ID and Client Secret. The Client Secret, like an API key, must be kept confidential. You will also define the necessary scopes (permissions) that your application will request from users.
5. Review Documentation: Always refer to the official Covid-19 API documentation accessible from the developer portal for the most current and detailed instructions on credential generation and management. Specific steps and dashboard layouts can evolve, making the official documentation the definitive source for this information.

Authenticated request example

Below are examples of how to make authenticated requests using both API Key and OAuth 2.0 methods. These examples demonstrate common patterns, and specific endpoint paths and parameters will vary based on the Covid-19 API you are calling.

API Key Example (using cURL)

For API Key authentication, the key is typically sent in a custom HTTP header, such as X-API-Key, or as a query parameter. Using a header is generally preferred for security.

curl -X GET \
  'https://api.covid19.example.com/v1/cases/daily?date=2026-05-28' \
  -H 'X-API-Key: YOUR_API_KEY_HERE'

Replace YOUR_API_KEY_HERE with your actual API key obtained from the Developer Dashboard.

OAuth 2.0 Example (using cURL)

For OAuth 2.0, you first need to obtain an access token. This example assumes you have already gone through the authorization flow and possess a valid access token. The access token is then typically included in the Authorization header using the Bearer scheme.

curl -X GET \
  'https://api.covid19.example.com/v1/users/me/vaccination-status' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN_HERE'

Replace YOUR_ACCESS_TOKEN_HERE with the access token issued to your application after a user has granted consent. The process of obtaining an access token usually involves redirecting the user to an authorization URL, where they log in and approve the request, after which an authorization code is exchanged for an access token at your configured redirect URI.

Security best practices

Adhering to security best practices is essential when integrating with the Covid-19 API, especially given the sensitive nature of health data. Proper credential management and secure coding practices help protect against unauthorized access and data breaches.

• Keep API Keys and Client Secrets Confidential: Never hardcode API keys or client secrets directly into your application's source code, especially for client-side applications. Store them in secure environment variables, a secrets management service (e.g., AWS Secrets Manager, Google Secret Manager), or a configuration file that is not publicly accessible or committed to version control. For client-side JavaScript applications, consider using a backend proxy to make API calls, preventing exposure of credentials directly in the browser.
• Use HTTPS/TLS Everywhere: All communication with the Covid-19 API must use HTTPS (TLS 1.2 or higher) to encrypt data in transit. This prevents man-in-the-middle attacks and protects sensitive data from being intercepted. The API enforces this by rejecting non-HTTPS requests.
• Implement Least Privilege: When generating API keys or configuring OAuth scopes, request and grant only the minimum necessary permissions required for your application's functionality. This limits the potential damage if a credential is compromised.
• Rotate Credentials Regularly: Periodically rotate your API keys and OAuth client secrets. This reduces the window of opportunity for an attacker if a credential is ever compromised. The Covid-19 Developer Dashboard typically provides functionality to generate new keys and revoke old ones.
• Validate and Sanitize Inputs: Always validate and sanitize any data your application sends to the Covid-19 API. This helps prevent injection attacks and ensures that your requests conform to the API's expected data formats.
• Handle Tokens Securely (OAuth 2.0):
  • Access Token Storage: Store access tokens securely, typically in memory for short durations or in encrypted storage if persistence is required, avoiding client-side storage like local storage or cookies without proper HttpOnly and Secure flags.
  • Refresh Tokens: If using refresh tokens, store them even more securely, as they can be used to obtain new access tokens. They should typically be stored in an HttpOnly, Secure cookie or encrypted database.
  • State Parameter: Always use a strong, unguessable state parameter during the OAuth authorization flow to prevent Cross-Site Request Forgery (CSRF) attacks.
• Monitor API Usage: Regularly monitor your application's API usage logs for any unusual activity, such as spikes in requests or access from unexpected IP addresses. Many API platforms, including Covid-19, offer dashboards or logging services for this purpose.
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures. Avoid exposing detailed error messages that could provide attackers with clues about your system's vulnerabilities.