Intrinio Authentication: Methods, Credentials, and Security

Authentication overview

Intrinio provides access to its financial data API primarily through an API key authentication model. This method requires developers to include a unique, secret key with each request to verify their identity and authorize access to data endpoints. The API supports both RESTful HTTP requests and WebSocket connections, both of which utilize the same API key for authentication.

The API key functions as a bearer token, identifying the user and their subscription level, which dictates access permissions and rate limits. Intrinio's API is designed to be straightforward, allowing developers to integrate financial data into applications, quantitative models, and research platforms after a simple key setup process. The API is accessible via HTTPS, ensuring that all data in transit is encrypted using Transport Layer Security (TLS) versions, which helps protect the confidentiality and integrity of communications between the client and the server, as detailed in the TLS 1.3 specification.

For ease of integration, Intrinio offers official Software Development Kits (SDKs) in several programming languages, including Python, Node.js, Ruby, Java, C#, and R. These SDKs abstract the underlying HTTP request details, including the secure handling and transmission of the API key, simplifying the development process for users.

Supported authentication methods

Intrinio's API primarily relies on a single, consistent authentication method across its REST and WebSocket interfaces: the API Key.

API Key

The API Key is a unique string generated for each user account. When making a request to the Intrinio API, this key must be provided to authenticate the request. It serves as both an identifier and a credential. Depending on the method of integration (direct HTTP request or SDK), the key is typically passed either as a query parameter or as part of the request header.

When to use API Key authentication:

• Direct API calls: For applications making raw HTTP requests to Intrinio's REST endpoints.
• WebSocket connections: When establishing a real-time data stream, the API key is used in the initial connection handshake.
• SDK integrations: Intrinio's official SDKs are designed to manage the API key transmission, simplifying its usage for developers.

The API key is associated with your Intrinio account and determines your access level to various datasets and your allotted rate limits. It is crucial to manage this key securely to prevent unauthorized access to your account and data.

Table: Intrinio Authentication Methods

Getting your credentials

To access the Intrinio API, you will need an API key. This key is provisioned through your Intrinio account.

1. Create an Intrinio Account: If you do not already have one, sign up for an account on the Intrinio website. They offer a Developer Plan that includes a free tier for non-commercial use, which is suitable for testing and development.
2. Access Your Dashboard: Log in to your Intrinio account.
3. Navigate to API Keys: Within your account dashboard, locate the section related to API Keys or Developer Settings. The exact navigation may vary but typically involves a link like "API Keys," "Settings," or "My Account." Refer to the Intrinio Getting Started guide for precise instructions.
4. Generate/Retrieve Key: Your API key will be displayed there. If one hasn't been automatically generated, there will be an option to generate a new key.
5. Copy Your API Key: Copy the unique string that represents your API key. This is your credential for all API interactions.

It is important to treat your API key as a sensitive credential, similar to a password. Do not hardcode it directly into client-side code, commit it to version control systems like Git, or expose it in public repositories.

Authenticated request example

This example demonstrates how to make an authenticated request to the Intrinio API using Python, one of the supported SDK languages. The example fetches historical stock prices for a given ticker.

import intrinio_sdk as intrinio
from intrinio_sdk.rest import ApiException
import os

# Configure API key authorization
# It's best practice to load your API key from environment variables
intrinio.ApiClient().set_api_key(os.environ.get('INTRINIO_API_KEY'))
# Alternatively, you can set it directly for testing (NOT recommended for production):
# intrinio.ApiClient().set_api_key('YOUR_API_KEY_HERE')

security_api = intrinio.SecurityApi()

ticker = 'AAPL'
start_date = '2023-01-01'
end_date = '2023-01-05'

try:
    # Get historical data for a security
    api_response = security_api.get_security_historical_data(
        identifier=ticker,
        tag='close_price',
        start_date=start_date,
        end_date=end_date
    )
    print(f"Historical close prices for {ticker} from {start_date} to {end_date}:")
    for item in api_response.historical_data:
        print(f"Date: {item.date}, Close Price: {item.value}")
except ApiException as e:
    print(f"Exception when calling SecurityApi->get_security_historical_data: {e}")
except Exception as e:
    print(f"An error occurred: {e}")

In this Python example:

1. The intrinio_sdk library is imported.
2. The API key is configured using intrinio.ApiClient().set_api_key(). The recommended approach is to load the key from an environment variable (os.environ.get('INTRINIO_API_KEY')) for security.
3. An instance of SecurityApi is created to access security-related endpoints.
4. The get_security_historical_data method is called with the ticker, data tag, and date range. The SDK handles the inclusion of the API key in the underlying HTTP request.
5. The response is then processed and printed.

For direct HTTP requests without an SDK, the API key would typically be included as a query parameter (?api_key=YOUR_API_KEY) or in the Authorization header (Authorization: Bearer YOUR_API_KEY), though Intrinio's documentation primarily shows examples with the query parameter for REST requests.

Security best practices

Securing your Intrinio API key is crucial to protect your account and prevent unauthorized access to financial data. Adhering to these best practices will help maintain the integrity and confidentiality of your API interactions:

• Keep API Keys Confidential: Treat your API key like a password. Do not share it publicly, commit it to version control systems (like Git) directly, or embed it directly into client-side code where it could be easily extracted.
• Use Environment Variables: For server-side applications, store your API key in environment variables rather than hardcoding it into your source code. This keeps the key separate from your codebase and allows for easier rotation without modifying application logic. For example, in Linux/macOS, you might use export INTRINIO_API_KEY="YOUR_KEY".
• Secure Production Environments: Ensure that your production servers and environments are properly secured. This includes limiting access to machines that host your application, using strong access controls, and regularly patching systems.
• Utilize HTTPS/TLS: All communication with the Intrinio API occurs over HTTPS, which encrypts data in transit using TLS. Always ensure your application strictly enforces HTTPS to prevent eavesdropping and man-in-the-middle attacks. This is a fundamental security measure for any API interaction, as explained by Cloudflare's explanation of SSL/TLS.
• Monitor API Usage: Regularly review your API usage logs (if provided by Intrinio) to detect any unusual activity that might indicate a compromised key or unauthorized access.
• Rotate API Keys Periodically: While Intrinio's documentation does not explicitly detail API key rotation, it is a general security practice to periodically regenerate and update your API keys. This reduces the risk exposure should a key ever be compromised. If Intrinio offers this functionality, leverage it.
• Implement Rate Limiting and Error Handling: While not strictly an authentication practice, robust error handling and respecting API rate limits can indirectly contribute to security by preventing abuse or denial-of-service attempts against your application using a legitimate key.
• Never Expose Keys on the Client-Side: For web applications, never embed your API key directly into JavaScript or other client-side code that executes in a user's browser. If your client-side application needs to access Intrinio data, route requests through your own secure backend server, which can then append the API key before forwarding the request to Intrinio.