FEC Authentication: API Key Setup & Best Practices (2026)

Authentication overview

The Federal Election Commission (FEC) provides a public API that allows developers to access campaign finance data, election results, and related information. Access to most endpoints of the FEC API requires an API key. This key serves as the primary method for authenticating requests, enabling the FEC to monitor usage, enforce rate limits, and ensure fair access for all users.

While the FEC API is publicly accessible and free to use, the API key helps manage the load on the system and prevent abuse. Without a valid API key, requests to protected endpoints will typically result in an authentication error or a rate limit message. The process for obtaining and using an API key is designed to be straightforward, supporting quick integration for various applications, from academic research to journalistic investigations.

Unlike some APIs that employ more complex authentication flows like OAuth 2.0 for user authorization, the FEC API focuses on application-level authentication. This means the API key identifies the application or developer making the request, rather than an individual end-user. This approach simplifies integration for data consumption where user-specific permissions are not a primary concern.

Supported authentication methods

The FEC API primarily supports a single authentication method: API keys. This method is suitable for public data APIs where the goal is to provide broad access while still maintaining some level of control over usage patterns.

The API key is a unique string that is typically passed as a query parameter in each API request. The FEC's system then validates this key against its records to determine if the request is authorized. If the key is valid, the request is processed, and the relevant data is returned. If the key is missing, invalid, or has exceeded its rate limits, the API will return an error response.

Other authentication methods, such as OAuth 2.0 or HTTP Basic Authentication, are not generally required or supported by the FEC API for public data access. These methods are often used for APIs that handle sensitive user data or require delegated authorization, which is not the primary function of the FEC's public data API.

Authentication Methods Table

Getting your credentials

Obtaining an API key for the FEC API is a free and straightforward process. Follow these steps to register and receive your key:

1. Visit the FEC Developer Page: Navigate to the official FEC API Developers page.
2. Locate the API Key Request Form: On the developer page, you will find a section or link to "Get an API key."
3. Provide Required Information: Typically, you will need to provide your email address. The FEC uses this email to send you the API key and potentially for communication regarding API updates or changes.
4. Receive Your API Key: After submitting the form, your API key will be sent to the email address you provided. This key is a unique alphanumeric string.
5. Store Your Key Securely: Once you receive your API key, it is important to store it securely. While it grants access to public data, exposing your key could lead to unauthorized use and impact your rate limits.

There are no approval processes or waiting periods beyond the time it takes for the email to arrive. The FEC aims to make data access as frictionless as possible for developers and researchers.

Authenticated request example

Once you have obtained your API key, you can include it in your API requests as a query parameter named api_key. Here are examples using curl, Python, and JavaScript to demonstrate how to make an authenticated request to the FEC API.

Curl Example

This curl command demonstrates how to fetch the top 10 presidential candidates for the 2024 election cycle, including your API key:

curl "https://api.open.fec.gov/v1/candidates/search/?api_key=YOUR_API_KEY&sort_hide_null=true&candidate_status=P&election_year=2024&per_page=10"

Replace YOUR_API_KEY with the actual key you received via email.

Python Example

Using the requests library in Python:

import requests

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://api.open.fec.gov/v1"

params = {
    "api_key": API_KEY,
    "sort_hide_null": "true",
    "candidate_status": "P",
    "election_year": "2024",
    "per_page": "10"
}

response = requests.get(f"{BASE_URL}/candidates/search/", params=params)

if response.status_code == 200:
    data = response.json()
    for candidate in data.get("results", []):
        print(f"Candidate Name: {candidate['name']}")
else:
    print(f"Error: {response.status_code} - {response.text}")

Remember to replace "YOUR_API_KEY" with your actual API key.

JavaScript (Fetch API) Example

Using the Fetch API in a web browser or Node.js environment:

const API_KEY = "YOUR_API_KEY";
const BASE_URL = "https://api.open.fec.gov/v1";

async function getCandidates() {
  const url = new URL(`${BASE_URL}/candidates/search/`);
  url.searchParams.append("api_key", API_KEY);
  url.searchParams.append("sort_hide_null", "true");
  url.searchParams.append("candidate_status", "P");
  url.searchParams.append("election_year", "2024");
  url.searchParams.append("per_page", "10");

  try {
    const response = await fetch(url.toString());
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    const data = await response.json();
    data.results.forEach(candidate => {
      console.log(`Candidate Name: ${candidate.name}`);
    });
  } catch (error) {
    console.error("Error fetching candidates:", error);
  }
}

getCandidates();

Ensure that "YOUR_API_KEY" is replaced with your actual key.

Security best practices

While API keys for public data APIs like the FEC's may seem less critical than those for private or transactional APIs, adhering to security best practices is still important. Proper handling of your API key helps prevent unauthorized usage, protects your rate limits, and maintains the integrity of your application's access to the data.

1. Keep Your API Key Confidential: Treat your API key as a sensitive credential. Do not hardcode it directly into client-side code (e.g., frontend JavaScript that runs in a user's browser) or publicly accessible repositories. If your key is exposed, others could use it, potentially impacting your application's ability to access the API due to rate limit exhaustion.
2. Use Environment Variables for Server-Side Applications: For server-side applications, store your API key in environment variables rather than directly in your codebase. This practice makes it easier to manage keys across different environments (development, staging, production) and reduces the risk of accidental exposure. The Google Cloud documentation on API key best practices also recommends this approach for server-side applications.
3. Avoid Committing Keys to Version Control: Never commit your API key directly into version control systems like Git. Use .gitignore files or similar mechanisms to exclude files containing sensitive credentials from your repositories.
4. Implement Rate Limit Handling: Understand the FEC API's rate limits (as detailed in their developer documentation) and implement proper error handling and retry logic in your application. This prevents your application from being temporarily blocked if it exceeds the allowed number of requests.
5. Regularly Review API Key Usage: Periodically check the usage of your API key if the FEC provides such monitoring tools. This can help identify any unusual activity that might indicate a compromised key.
6. Use HTTPS for All Requests: Always ensure that your API requests are made over HTTPS. This encrypts the communication between your application and the FEC API, protecting your API key and the data exchanged from interception during transit. This is a fundamental web security practice, as outlined by the Mozilla Developer Network's guide on secure contexts.

By following these best practices, you can ensure secure and reliable access to the FEC's valuable public datasets.