Enigma Public Authentication: API Key Access & Best Practices (2026)

Authentication overview

Enigma Public provides access to its enterprise data products primarily through direct data delivery mechanisms and API integrations for its enterprise clients. Authentication for these services is a critical component of establishing secure connections and ensuring that only authorized systems can access licensed datasets. Given the bespoke nature of Enigma Public's data licensing and integration, the specific authentication methods and procedures are typically established during the client onboarding process, requiring consultation with their sales and technical teams Enigma Public Contact Sales.

The system is designed to provide secure access to proprietary and public data collected and curated by Enigma Public, which includes business intelligence, economic research, and competitive analysis data. Enigma Public's commitment to security is reflected in its SOC 2 Type II compliance Enigma Public homepage, which applies to its operational processes, including data access and authentication.

Supported authentication methods

Enigma Public primarily supports API Key authentication for its direct API integrations. This method is common for server-to-server communication where a client application needs to access data from an external service. API keys serve as a unique identifier and secret token provided to authenticated clients.

For data delivery via SFTP or AWS S3, authentication mechanisms align with those platforms. SFTP access typically uses username/password credentials or SSH keys for secure file transfer. AWS S3 access leverages AWS Identity and Access Management (IAM) roles and policies, or temporary security credentials, to control access to S3 buckets containing the data. These methods ensure that access to data assets is governed by established cloud security best practices AWS Security Credentials documentation.

Getting your credentials

Access to Enigma Public's data APIs and direct delivery services, including the necessary authentication credentials, is part of a custom enterprise solution. This process begins with an engagement with Enigma Public's sales team to define specific data needs and integration requirements. Once an agreement is in place, the technical onboarding process will involve the provisioning of the appropriate credentials:

• API Keys: For API integrations, unique API keys are generated and securely communicated to the client's development team. These keys are tied to the client's account and specific data entitlements.
• SFTP Credentials: For SFTP data delivery, clients receive a username, password, and host address. SSH key authentication may also be configured for enhanced security.
• AWS S3 Access: For AWS S3 delivery, Enigma Public works with clients to configure appropriate IAM roles or provides temporary credentials for secure access to designated S3 buckets. This often involves cross-account access configurations AWS IAM roles for cross-account access to allow the client's AWS environment to access Enigma Public's data buckets securely.

Clients should expect a guided setup process with Enigma Public's technical support team to ensure correct configuration and secure handling of all credentials.

Authenticated request example

While specific API endpoints and request structures are customized for each enterprise client, a general example for an API key-authenticated request might look like the following using a common HTTP client like curl. This assumes the API key is passed in a custom HTTP header, which is a common and secure practice.

curl -X GET \
  'https://api.enigma.com/data/v1/your-dataset-endpoint' \
  -H 'X-API-Key: YOUR_ENIGMA_API_KEY' \
  -H 'Accept: application/json'

In this example:

• https://api.enigma.com/data/v1/your-dataset-endpoint represents a placeholder for the specific API endpoint provided by Enigma Public for accessing your licensed dataset.
• X-API-Key: YOUR_ENIGMA_API_KEY is the critical authentication header. Replace YOUR_ENIGMA_API_KEY with the actual API key issued to your organization.
• -H 'Accept: application/json' indicates that the client prefers a JSON response, a common format for RESTful APIs.

The exact header name for the API key (e.g., Authorization with a Bearer token, or a custom header) will be specified during your technical onboarding with Enigma Public. Always refer to the specific integration documentation provided by Enigma for accurate request construction.

Security best practices

To maintain the security of your data access and comply with Enigma Public's security standards, implement the following best practices for managing and using your authentication credentials:

1. Keep API Keys Secret: Treat API keys as sensitive as passwords. Do not hardcode them directly into client-side code, commit them to version control systems (like Git), or expose them in public repositories. Store API keys securely in environment variables, secret management services, or encrypted configuration files.
2. Use Environment Variables: For server-side applications, store API keys in environment variables. This prevents them from being directly visible in your codebase and makes it easier to manage different keys for various environments (development, staging, production).
3. Implement Least Privilege: Ensure that the credentials (API keys, IAM roles, SFTP users) are granted only the minimum necessary permissions required to perform their intended functions. Avoid using root or administrative credentials for routine data access.
4. Rotate Credentials Regularly: Periodically rotate your API keys and other access credentials. This reduces the window of opportunity for an attacker to use compromised credentials. Enigma Public's technical team can provide guidance on key rotation procedures.
5. Monitor API Usage: Implement logging and monitoring for API calls made with your credentials. Anomalous activity could indicate a compromise.
6. Secure Communication Channels: Always use HTTPS/TLS for all API communications to ensure data is encrypted in transit and protected from eavesdropping and tampering. Enigma Public's APIs are expected to enforce HTTPS by default.
7. IP Whitelisting: If supported by Enigma Public, restrict API key usage to a predefined list of trusted IP addresses. This adds an extra layer of security by ensuring that requests originating from unauthorized locations are rejected.
8. Error Handling: Design your application to handle authentication failures gracefully without leaking sensitive information. For example, a generic "Authentication Failed" message is preferable to one that reveals specific reasons for failure.
9. Secure Development Lifecycle: Integrate security considerations throughout your development lifecycle, from design to deployment and maintenance. Regularly audit your code and infrastructure for vulnerabilities.

Adhering to these practices helps protect your access to Enigma Public's valuable data resources and maintains the integrity of your data integrations.