HERE Technologies Authentication: API Key & OAuth 2.0 (2026)

Authentication overview

Authentication for HERE Technologies services ensures that only authorized applications and users can access mapping, routing, and location-based APIs. HERE Technologies supports two primary authentication methods: API Keys and OAuth 2.0. The choice between these methods depends on the specific application architecture, security requirements, and the nature of the data being accessed.

API Keys offer a straightforward approach for identifying an application and are suitable for many common use cases, particularly when interactions are server-to-server or when client-side requests do not involve user-specific data. OAuth 2.0 provides a more robust and flexible framework for delegated authorization, allowing applications to access protected resources on behalf of a user without exposing their credentials. All API communication with HERE Technologies services must occur over HTTPS/TLS to encrypt data in transit, protecting against eavesdropping and tampering, as specified by common web security practices documented by organizations such as the W3C Web Security FAQ.

Supported authentication methods

HERE Technologies provides distinct authentication mechanisms designed to accommodate various integration scenarios:

API Key authentication

API Key authentication is a simple, token-based mechanism where a unique string (the API Key) is included with each request to identify the calling application. This method is generally recommended for:

• Server-side applications: Where the API Key can be securely stored and managed.
• Client-side applications (with careful consideration): For public data access where the risk of key exposure is mitigated by usage restrictions or rate limits.
• Quick prototyping and development: Due to its ease of implementation.

When using API Keys, it is critical to secure the key to prevent unauthorized usage. HERE Technologies provides tools within its Developer Portal to manage API Keys, including options to restrict key usage by referrer (HTTP referrer or IP address) to enhance security.

OAuth 2.0 authentication

OAuth 2.0 is an industry-standard protocol for authorization that enables applications to obtain limited access to user accounts on an HTTP service, such as HERE Technologies's platform, without giving away user credentials. It is particularly suitable for:

• Client-side applications: Mobile and web applications that need to access user-specific data or perform actions on behalf of a user.
• Service-to-service communication: Where applications need to securely communicate and exchange data without direct user interaction, using client credentials flow.
• Enhanced security requirements: When greater control over token validity, scope, and refresh mechanisms is needed.

HERE Technologies implements OAuth 2.0 flows that involve obtaining an access token, which is then used in subsequent API requests. The specific workflow depends on the grant type chosen (e.g., Authorization Code flow for web applications, Client Credentials flow for server-to-server interactions). The process typically involves:

1. Registering your application to obtain a Client ID and Client Secret.
2. Directing the user to HERE Technologies for authorization (for user-based flows).
3. Exchanging an authorization code for an access token.
4. Using the access token in the Authorization header of API requests.

A comprehensive understanding of OAuth 2.0 specifications is beneficial for implementing this method securely and effectively.

Comparison of authentication methods

The following table summarizes the key characteristics and suitable use cases for each authentication method:

Getting your credentials

To begin using HERE Technologies APIs, you must first obtain the necessary credentials through the HERE Developer Portal. The process typically involves:

1. Creating a HERE Developer Account: If you don't already have one, sign up on the HERE Developer Portal.
2. Creating a Project: Within your account, create a new project. Projects serve as containers for your applications and associated credentials.
3. Generating API Keys: For API Key authentication, navigate to your project and generate a new API Key. You can configure restrictions such as allowed HTTP referrers or IP addresses directly from the portal to enhance security.
4. Registering an OAuth 2.0 Application: If you opt for OAuth 2.0, you will need to register an application within your project. This registration process will provide you with a unique Client ID and Client Secret. You will also need to specify redirect URIs, which are crucial for security in Authorization Code flows.

It is important to keep your Client ID, Client Secret, and API Keys confidential. Treat them as sensitive information and store them securely, never embedding them directly in client-side code without appropriate precautions.

Authenticated request example

The following examples demonstrate how to make an authenticated request using both API Key and OAuth 2.0 for a typical HERE Technologies API endpoint, such as the Geocoding API.

API Key example (JavaScript)

This example shows a simple fetch request incorporating an API Key for a client-side application. For server-side applications, the API Key would be loaded from a secure environment variable.

const apiKey = 'YOUR_HERE_API_KEY'; // Replace with your actual API Key
const query = '200 S Mathilda Ave, Sunnyvale, CA';

fetch(`https://geocode.search.hereapi.com/v1/geocode?q=${encodeURIComponent(query)}&apiKey=${apiKey}`)
  .then(response => response.json())
  .then(data => {
    console.log('Geocoding results (API Key):', data);
  })
  .catch(error => {
    console.error('Error fetching geocoding data:', error);
  });

OAuth 2.0 example (Node.js - Client Credentials Grant)

This server-side example demonstrates the Client Credentials flow to obtain an access token and then use it to authenticate a request. This flow is suitable for server-to-server communication where there is no user context.

const fetch = require('node-fetch'); // npm install node-fetch

const clientId = 'YOUR_HERE_CLIENT_ID';
const clientSecret = 'YOUR_HERE_CLIENT_SECRET';

async function getAccessToken() {
  const authString = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
  const tokenUrl = 'https://account.api.here.com/oauth2/token';

  const response = await fetch(tokenUrl, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': `Basic ${authString}`
    },
    body: 'grant_type=client_credentials'
  });

  const data = await response.json();
  if (response.ok) {
    return data.access_token;
  } else {
    throw new Error(`Failed to get access token: ${data.error_description || data.error}`);
  }
}

async function makeAuthenticatedRequest() {
  try {
    const accessToken = await getAccessToken();
    console.log('Obtained Access Token:', accessToken);

    const query = 'Eiffel Tower';
    const apiUrl = `https://geocode.search.hereapi.com/v1/geocode?q=${encodeURIComponent(query)}`;

    const apiResponse = await fetch(apiUrl, {
      method: 'GET',
      headers: {
        'Authorization': `Bearer ${accessToken}`
      }
    });

    const apiData = await apiResponse.json();
    console.log('Geocoding results (OAuth 2.0):', apiData);
  } catch (error) {
    console.error('Authentication or API request failed:', error);
  }
}

makeAuthenticatedRequest();

For more detailed code examples and specific API endpoints, refer to the HERE Technologies API reference documentation.

Security best practices

Implementing strong authentication is only one part of securing your application. Adhering to general security best practices is essential for protecting your credentials and users' data when integrating with HERE Technologies APIs:

• Protect your API Keys and Client Secrets:
  • Never embed API Keys or Client Secrets directly in publicly accessible client-side code (e.g., JavaScript in a web page, mobile app bundles) without appropriate restrictions. For front-end applications, use referrer restrictions or proxy requests through your own secure backend.
  • Store API Keys and Client Secrets in secure environment variables, a dedicated secrets management service (e.g., AWS Secrets Manager, Google Secret Manager), or a secure configuration file on your server.
  • Regularly rotate API Keys and Client Secrets, especially if there's any suspicion of compromise.
• Use HTTPS/TLS for all communication: All requests to HERE Technologies APIs should be made over HTTPS to encrypt data in transit and prevent Man-in-the-Middle attacks. HERE Technologies API endpoints enforce HTTPS.
• Implement referrer restrictions: For API Keys used in web applications, configure HTTP referrer restrictions in the HERE Developer Portal to limit API Key usage to your specific domain(s). For server-side applications, use IP address restrictions.
• Scope access tokens appropriately: When using OAuth 2.0, request only the minimum necessary scopes (permissions) for your application. This limits the damage if an access token is compromised.
• Handle tokens securely:
  • Store access tokens and refresh tokens securely. For web applications, consider using HTTP-only cookies for refresh tokens to mitigate XSS attacks.
  • Validate tokens when received and ensure they haven't expired before use.
• Implement robust error handling: Properly handle authentication errors and API rate limits. Avoid exposing sensitive information in error messages to users.
• Review audit logs: Regularly review access logs and usage statistics in the HERE Developer Portal to detect unusual activity that could indicate unauthorized access.
• Stay updated: Keep your SDKs and libraries up to date to benefit from the latest security patches and features provided by HERE Technologies and the broader developer ecosystem.