What is the primary authentication method for GeoApi?

GeoApi's primary authentication method is through API keys. You include a unique API key as a query parameter in your requests to identify and authorize your application.

How do I get my GeoApi API key?

You can obtain your API key by registering for an account on the GeoApi website and then accessing your developer dashboard. The key is typically generated automatically upon account creation.

Can I use GeoApi without an API key?

No, all requests to GeoApi's services require a valid API key for authentication and to track usage against your account's quotas, including the free tier.

How can I secure my GeoApi API key?

To secure your API key, you should set HTTP referrer restrictions for web applications or IP address restrictions for server-side applications. Avoid hardcoding keys; use environment variables for server-side integrations, and consider a proxy server for client-side access.

What happens if my GeoApi API key is compromised?

If your API key is compromised, unauthorized parties could use your API services, potentially leading to unexpected charges or quota exhaustion. You should immediately revoke the compromised key from your GeoApi dashboard and generate a new one.

Does GeoApi support OAuth 2.0 or other authentication methods?

As of current documentation, GeoApi primarily supports API key authentication. More complex methods like OAuth 2.0 are not listed as supported for general API access.

Can I set usage limits or alerts for my API key?

Yes, it is generally possible to monitor your API usage through your GeoApi dashboard and configure alerts for unusual activity or when approaching your quota limits. Check the dashboard for specific settings.

GeoApi Authentication: API Key Setup and Security (2026)

Authentication overview

GeoApi secures access to its suite of geospatial services primarily through API keys. These keys serve as unique identifiers for your application when it communicates with GeoApi's various endpoints, including the Geocoding API, Places API, and Routing API. The API key model provides a straightforward mechanism for developers to manage access and track usage across their projects. Requests made to GeoApi services must include a valid API key for successful authorization.

While API keys offer simplicity, their security relies heavily on proper implementation and management practices. Unlike more complex authentication flows like OAuth 2.0, API keys alone do not provide user-level consent or token refresh mechanisms. Instead, they act as a secret token that grants access to the services associated with your GeoApi account. It is crucial to protect these keys to prevent unauthorized usage and potential service abuse.

Supported authentication methods

GeoApi exclusively uses API keys for authenticating requests to its services. This method involves embedding a unique string (the API key) directly into the request URL or headers. This approach is common for public APIs where the primary goal is to identify the calling application rather than an individual user.

API Key

An API key is a token that a client provides when making API calls. It is typically a long, randomly generated string that acts as both an identifier and a secret. When you send an API request to GeoApi, you append your API key as a query parameter in the URL. This allows GeoApi to verify your identity and ensure you have permission to access the requested resources and that your usage aligns with your account's quotas.

The table below summarizes the characteristics of GeoApi's API key authentication method:

Method	When to Use	Security Level (Requires Management)
API Key	Identifying applications for server-to-server or client-side requests where user context is not required.	Moderate (requires careful key restriction and protection against exposure).

Getting your credentials

To obtain your GeoApi API key, you need to register for an account on the GeoApi website. Upon successful registration, an API key is automatically generated for your account. You can manage and retrieve your API keys from your GeoApi developer dashboard.

Sign Up/Log In: Navigate to the GeoApi homepage and either create a new account or log in to an existing one.
Access Dashboard: Once logged in, you will be redirected to your personal dashboard.
Locate API Keys: Within the dashboard, there will be a dedicated section, typically labeled 'API Keys' or 'Projects', where your active API key is displayed. You may also have the option to generate additional keys or manage existing ones, including setting restrictions.

It is recommended to set restrictions on your API keys whenever possible. These restrictions can limit where your API key can be used, such as specifying allowed HTTP referrers for web applications or allowed IP addresses for server-side applications. This adds a crucial layer of security, minimizing the impact if a key is accidentally exposed.

Authenticated request example

Authenticating with GeoApi involves adding your API key as a query parameter in your HTTP requests. The parameter name is consistently apiKey across all GeoApi services. Here's an example using cURL to make a simple Geocoding API request:

Example: Geocoding a physical address

curl "https://api.geoapify.com/v1/geocode/search?text=38%20Upper%20Montagu%20Street%2C%20London%20W1H%201FP%2C%20United%20Kingdom&apiKey=YOUR_GEOAPIFY_API_KEY"

In this example, YOUR_GEOAPIFY_API_KEY should be replaced with your actual API key obtained from your GeoApi dashboard. For more detailed examples across various programming languages, refer to the GeoApi API documentation.

When integrating into web applications using JavaScript, you might structure your fetch request as follows:

const apiKey = 'YOUR_GEOAPIFY_API_KEY';
const address = '1600 Amphitheatre Parkway, Mountain View, CA';

fetch(`https://api.geoapify.com/v1/geocode/search?text=${encodeURIComponent(address)}&apiKey=${apiKey}`)
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(error => console.error('Error fetching geocoding data:', error));

For server-side applications, it's generally safer to store your API key in environment variables rather than hardcoding it directly into your source code. This practice prevents the key from being committed to version control systems like Git, where it could be accidentally exposed.

Security best practices

Securing your GeoApi API keys is essential to prevent unauthorized access, control costs, and maintain the integrity of your applications. Adhere to the following best practices:

Restrict API Keys:
- HTTP Referrer Restrictions: For web applications, configure your API key to only accept requests originating from specific domains or URLs. This is a primary defense against unauthorized use on other websites.
- IP Address Restrictions: For server-side applications, restrict your API key to only accept requests from a specific set of IP addresses. This ensures that only your authorized servers can use the key.
- Refer to the GeoApi API Key Security Guide for specific instructions on setting these restrictions.
Do Not Embed Keys Directly in Code: Avoid hardcoding API keys directly into your application's source code, especially for client-side applications. If client-side embedding is unavoidable (e.g., for JavaScript map rendering), ensure referrer restrictions are in place.
Use Environment Variables for Server-Side Keys: For backend services, store API keys in environment variables or secure configuration management systems. This prevents keys from being exposed in source code repositories or build artifacts. This practice is detailed in various security guides for cloud platforms, such as Google Cloud's API key best practices.
Employ a Proxy Server for Client-Side Access: For web or mobile applications, consider routing API requests through your own backend proxy server. Your client application calls your proxy, which then calls GeoApi with the securely stored API key. This completely shields the API key from the client.
Regular Key Rotation: Periodically rotate your API keys. This means generating a new key, updating your applications to use the new key, and then revoking the old key. This mitigates the risk associated with long-lived keys.
Monitor Usage and Alerts: Regularly review your GeoApi usage statistics in your dashboard. Set up usage alerts if available to be notified of unexpected spikes in activity, which could indicate unauthorized use.
Revoke Compromised Keys Immediately: If you suspect an API key has been compromised, revoke it immediately from your GeoApi dashboard. Generate a new key and update your applications.
Least Privilege Principle: If GeoApi offered different types of API keys with varying permissions, always use the key with the minimum necessary permissions for a given task. While GeoApi's keys provide general access, understanding this principle is good practice for any API integration.
Secure Development Lifecycle: Integrate API key security into your overall secure development lifecycle, including code reviews and security testing, to ensure that keys are handled appropriately throughout your application's development and deployment.