French Address Search Authentication: API Access (2026)

Authentication overview

The French Address Search API, officially known as the API Nationale Adresse, operates under a unique authentication model compared to many commercial APIs. It is designed as a public service, making the underlying data freely accessible without the need for API keys, tokens, or other traditional authentication mechanisms. This approach simplifies integration for developers and applications that require French address validation, geocoding, and reverse geocoding capabilities. The API serves as a cornerstone for accessing the official French national address database, maintained by Etalab, a department of the French Prime Minister's office.

While authentication is not required, adherence to standard web security practices, such as using HTTPS, is essential for data integrity and confidentiality in transit. The API's open access model aligns with principles of open data, facilitating its use across public sector initiatives, research projects, and commercial applications that integrate governmental datasets. Developers can directly query the API endpoints using standard HTTP methods, receiving responses in JSON format.

Supported authentication methods

Given the API's public nature, there are no specific authentication methods to configure or manage. This means the service does not support common authentication schemes such as API keys, OAuth 2.0, JWTs, or basic authentication. The design choice reflects a commitment to open data and ease of access. However, it is always recommended to use secure communication protocols.

Developers should ensure that all API requests are made over HTTPS to encrypt the communication channel between the client application and the API server. This protects any transmitted data, even if it's not sensitive in the context of API keys. The use of HTTPS is a fundamental best practice for any web service interaction, as detailed by organizations like the Internet Engineering Task Force in RFC 2818, which outlines HTTP over TLS.

Getting your credentials

Since the French Address Search API does not require authentication, there are no credentials (e.g., API keys, client IDs, client secrets) to obtain. Developers can begin using the API immediately after reviewing the official API documentation. This streamlined approach removes the typical setup overhead associated with API integration, allowing for quicker development cycles.

To access the API, you simply need a functional HTTP client or a web browser capable of making GET requests. There is no registration process, no account setup, and no approval workflow for API access. This makes it particularly suitable for projects requiring rapid prototyping or integration into systems where credential management might add unnecessary complexity.

While no credentials are needed, developers should still familiarize themselves with the API's usage policies, rate limits (if any are implicitly enforced by server capacity), and data attribution requirements, which are typically outlined in the service's documentation. Although explicit rate limits are not prominently advertised as part of an authenticated scheme, responsible consumption of public resources is always advised.

Authenticated request example

As the French Address Search API does not use authentication, an example request is a standard HTTP GET call. Here’s how you would typically search for an address using cURL, one of the primary language examples provided for the API:

curl "https://api-adresse.data.gouv.fr/search/?q=8%20rue%20de%20paris%20lyon&limit=1"

In this example:

• https://api-adresse.data.gouv.fr/search/ is the base endpoint for address search.
• ?q=8%20rue%20de%20paris%20lyon is the query parameter for the address to be searched, URL-encoded.
• &limit=1 is an optional parameter to restrict the number of results returned.

The API will return a JSON response containing address suggestions or geographical coordinates. No headers for API keys or tokens are needed. This direct access model simplifies the integration process significantly, aligning with the principles of open data and public service accessibility.

For more detailed examples and available parameters, consult the French Address Search API reference, which provides comprehensive information on all supported endpoints and their functionalities.

Security best practices

Even without traditional authentication, adhering to general web security best practices is crucial when integrating with the French Address Search API:

1. Always use HTTPS: Ensure all calls to api-adresse.data.gouv.fr are made over HTTPS. This encrypts data in transit, protecting against eavesdropping and man-in-the-middle attacks. While there are no sensitive credentials to protect, using HTTPS is standard for all web communications to maintain data integrity and user trust. The Mozilla Developer Network provides a detailed explanation of why HTTPS is critical for web security.

2. Validate and Sanitize Inputs: Although the API is public, invalid or malicious input can still cause unexpected behavior or consume unnecessary resources. Always validate and sanitize any user-provided data before sending it to the API to prevent injection vulnerabilities or malformed requests.

3. Handle Responses Securely: Process API responses carefully. If the data is displayed to users, ensure it is properly escaped to prevent cross-site scripting (XSS) vulnerabilities. Store any processed data in a secure manner if persistence is required, following data protection regulations relevant to your application's jurisdiction.

4. Implement Robust Error Handling: Design your application to gracefully handle potential API errors or unavailable services. This includes network issues, malformed requests that result in API-side errors, or other unexpected responses. Proper error handling can prevent application crashes and improve user experience.

5. Monitor Usage: While there are no explicit API keys for rate limiting, it's good practice to monitor your application's usage of any public API. This helps in identifying unexpected traffic patterns, debugging integration issues, and ensuring responsible consumption of the public resource. If specific usage limits were to be introduced in the future, monitoring would aid in adherence.

6. Stay Updated with Documentation: Periodically review the official French Address Search API documentation for any updates, changes in usage policies, or new features. While the authentication model is stable, other aspects of the API might evolve.

7. Client-side vs. Server-side Calls: For applications running in a browser, direct client-side calls to public APIs like this one are common. However, for applications where the API call might expose sensitive user context (even if the API itself isn't authenticated), consider routing requests through a server-side proxy to add an additional layer of control and potentially apply application-specific rate limiting or logging.