Longdo Map Authentication: API Key Setup & Security (2026)

Authentication overview

Longdo Map employs API keys as its primary method for authenticating requests to its various geospatial services, including the Longdo Map API, Longdo Geocoding API, Longdo Routing API, and Longdo Search API. An API key is a unique alphanumeric string that identifies the calling application or user when making requests to Longdo Map's endpoints. This mechanism allows Longdo Map to manage access, monitor usage against defined pricing tiers, and apply rate limits to ensure fair usage across its infrastructure.

When an application makes a request to a Longdo Map API, the API key must be included in the request parameters. The Longdo Map server then validates this key. If the key is valid and authorized for the requested service, the API processes the request and returns the appropriate data. If the key is missing, invalid, or unauthorized, the API will typically return an error response, preventing access to the service. This approach is common for public-facing APIs where the primary goal is to identify the consumer and manage their access rights rather than authenticate an individual user's identity.

Developers implementing Longdo Map services should understand the implications of API key security. Unlike token-based authentication methods such as OAuth 2.0, which often involve short-lived tokens and refresh mechanisms, API keys are typically long-lived credentials. This characteristic necessitates careful handling and protection to prevent unauthorized use, which could lead to exceeding usage quotas or potential service abuse. Best practices for API key management are therefore critical for any application integrating Longdo Map APIs.

Supported authentication methods

Longdo Map exclusively supports API key authentication for accessing its services. This method is straightforward to implement and manage, making it suitable for a wide range of web and mobile applications.

API Key Implementation Details

When using the Longdo Map JavaScript SDK, the API key is typically initialized when loading the map. For direct REST API calls, the key is usually passed as a query parameter named key or apiKey, depending on the specific endpoint. The Longdo Map documentation provides detailed examples for each API endpoint, illustrating the correct parameter name and placement for the API key.

For instance, a request to a Longdo Map Geocoding endpoint might look like https://api.longdo.com/map/geocoding?query=address&key=YOUR_API_KEY. The presence and validity of YOUR_API_KEY are essential for the request to succeed. Developers should refer to the Longdo Map API reference for specific endpoint requirements regarding API key inclusion.

Getting your credentials

To obtain an API key for Longdo Map, you must register for a developer account on their platform. The process typically involves the following steps:

1. Register for a Longdo Map Developer Account: Navigate to the Longdo Map website and locate the developer or API section. You will need to sign up for an account, which usually involves providing an email address and creating a password.
2. Access the Developer Console: After successful registration and login, you should be directed to a developer console or dashboard. This is where you manage your applications and API keys.
3. Create a New Project/Application: Within the console, you may need to create a new project or application entry. This helps organize your API keys and track usage for different applications separately.
4. Generate an API Key: Once a project is set up, there will be an option to generate a new API key. The platform will typically provide a unique alphanumeric string.
5. Configure API Key Restrictions (Optional but Recommended): Longdo Map allows you to add restrictions to your API keys, such as HTTP referrer restrictions (for web applications) or IP address restrictions (for server-side applications). This security measure helps prevent unauthorized use of your key if it is accidentally exposed. For web applications, you would typically specify the domain(s) from which API requests are allowed to originate. For server-side applications, you would list the IP addresses of your servers.
6. Copy and Store Your API Key: Once generated, copy your API key and store it securely. Longdo Map often advises against hardcoding keys directly into source code, especially for client-side applications.

It is crucial to follow the instructions provided in the official Longdo Map documentation for the most accurate and up-to-date credential retrieval process, as interfaces and steps can evolve over time.

Authenticated request example

This example demonstrates how to make an authenticated request to a Longdo Map API using JavaScript, specifically integrating with the Longdo Map JavaScript SDK. This method is common for web-based mapping applications.

JavaScript SDK Example (Client-side)

When embedding a Longdo Map directly into a web page, the API key is typically passed during the map initialization process. This example shows how to load the Longdo Map SDK and display a basic map.

<!DOCTYPE html>
<html>
<head>
    <title>Longdo Map Example</title>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <style type="text/css">
        html, body { margin: 0; padding: 0; height: 100%; }
        #map { height: 100%; width: 100%; }
    </style>
    <script type="text/javascript" src="https://map.longdo.com/mmmap/mmmap.js?key=YOUR_API_KEY"></script>
    <script>
        var map;
        function init() {
            map = new longdo.Map({ 
                placeholder: document.getElementById('map'),
                zoom: 10,
                center: { lon: 100.5333, lat: 13.7333 } // Bangkok coordinates
            });
        }
    </script>
</head>
<body onload="init();">
    <div id="map"></div>
</body>
</html>

In this HTML snippet, YOUR_API_KEY must be replaced with your actual API key obtained from the Longdo Map developer console. The key is included directly in the src attribute of the <script> tag that loads the Longdo Map SDK. For production environments, it is recommended to restrict this API key to specific HTTP referrers (your website domains) to prevent unauthorized usage.

REST API Example (Server-side with Node.js)

For server-side applications or when making direct API calls, the key is typically passed as a query parameter. Here's an example using Node.js to make a request to a hypothetical Longdo Map Geocoding API endpoint.

const axios = require('axios');

const LONGDO_API_KEY = process.env.LONGDO_MAP_API_KEY; // Stored securely as an environment variable
const query = 'ถนนสุขุมวิท กรุงเทพมหานคร'; // Sukhumvit Road, Bangkok

async function geocodeAddress() {
    if (!LONGDO_API_KEY) {
        console.error('LONGDO_MAP_API_KEY environment variable is not set.');
        return;
    }

    try {
        const response = await axios.get('https://api.longdo.com/map/geocoding', {
            params: {
                query: query,
                key: LONGDO_API_KEY
            }
        });

        console.log('Geocoding Results:', response.data);
    } catch (error) {
        console.error('Error during geocoding:', error.response ? error.response.data : error.message);
    }
}

geocodeAddress();

In this Node.js example, the API key is retrieved from an environment variable (process.env.LONGDO_MAP_API_KEY). This is a critical security practice for server-side applications, as it prevents the key from being hardcoded into the codebase and exposed in version control systems. The axios library is used to make an HTTP GET request, with the API key passed as a query parameter named key. This approach ensures that the API key is handled securely on the server and is not exposed to client-side users.

Security best practices

Securing your Longdo Map API keys is essential to prevent unauthorized usage, protect your account from exceeding usage limits, and maintain the integrity of your applications. Adhere to the following best practices:

• Restrict API Keys: Always apply API key restrictions. For web applications, use HTTP referrer restrictions to specify the domains that can use the key. For server-side applications, use IP address restrictions to limit usage to your server's IP addresses. This significantly reduces the risk if a key is exposed.
• Do Not Embed Keys Directly in Client-Side Code Without Restrictions: While the Longdo Map JavaScript SDK example above shows the key in the script tag, it is imperative to apply HTTP referrer restrictions. Without them, anyone can view your key in the browser's source code and use it. For purely client-side applications that cannot use referrer restrictions effectively, consider a proxy server approach.
• Use Environment Variables for Server-Side Keys: For server-side applications (e.g., Node.js, Python, Java backends), never hardcode API keys directly into your source code. Instead, store them as environment variables or in secure configuration files that are not committed to version control. This prevents accidental exposure in Git repositories.
• Rotate API Keys Regularly: Periodically generate new API keys and replace old ones. This practice minimizes the window of opportunity for a compromised key to be exploited. Longdo Map's developer console should provide functionality for key rotation.
• Monitor API Usage: Regularly check your API usage statistics in the Longdo Map developer console. Unusual spikes in usage could indicate unauthorized access or a compromised key. Set up alerts if available to be notified of unexpected activity.
• Implement a Proxy Server for Sensitive Client-Side Operations: If your application needs to perform sensitive API calls (e.g., those that might reveal user data or incur high costs) from the client side, consider routing these requests through your own secure backend server. Your backend server can then add the API key securely before forwarding the request to Longdo Map, and apply its own rate limiting and validation.
• Understand Rate Limits and Quotas: Be aware of Longdo Map's API rate limits and usage quotas. Design your application to handle these limits gracefully (e.g., with exponential backoff and retry mechanisms) to avoid unnecessary errors and ensure your application remains functional.
• Secure Your Developer Account: Use a strong, unique password for your Longdo Map developer account. If available, enable two-factor authentication (2FA) to add an extra layer of security.

By diligently following these security practices, developers can significantly enhance the protection of their Longdo Map integrations and mitigate potential risks associated with API key management. The general principles of API key security are widely applicable across various platforms, as detailed in API key security best practices from Kong, a leading API gateway provider.