Non-Working Days Authentication: API Key Guide (2026)

Authentication overview

Non-Working Days utilizes API keys as its primary method for authenticating requests to its Holiday API. This approach provides a straightforward way for developers to secure access to the global holiday data required for applications such as scheduling, payroll systems, and business logic that depends on public holiday information. API keys serve as a unique identifier and secret token that clients must provide with each request, allowing the Non-Working Days server to verify the legitimacy of the caller and enforce usage limits, particularly for the Non-Working Days free tier and various paid plans.

The system is designed to be compatible with standard RESTful API practices, where the API key is typically passed as a query parameter or in a request header. This design simplifies integration into a wide range of programming environments, as demonstrated by the provided code examples in languages like cURL, Python, and JavaScript in the Non-Working Days developer documentation. Understanding how to securely manage and transmit these keys is essential for maintaining the integrity and availability of applications that rely on Non-Working Days data.

Supported authentication methods

Non-Working Days primarily supports API key authentication for accessing its services. This method is widely adopted for its simplicity and effectiveness in managing access to web APIs. An API key is a unique string of characters that identifies the calling application or user. When a request is made to the Non-Working Days API, this key is included to authorize the request.

The following table outlines the supported authentication method for the Non-Working Days API:

While API keys offer a practical solution for many use cases, it's important to understand their limitations, particularly concerning their static nature. Unlike token-based authentication methods such as OAuth, API keys do not typically expire unless manually revoked and do not inherently provide granular permissions beyond what the key itself is configured for, which is usually full access to the associated account's API quota.

Getting your credentials

To obtain your API key for Non-Working Days, you must first create an account on their platform. After successful registration, the API key will be available within your account dashboard. The process typically involves these steps:

1. Sign Up/Log In: Navigate to the Non-Working Days website and sign up for a new account or log in if you already have one. A free tier is available, offering 1000 requests per month, which allows you to obtain a key and begin testing.
2. Access Dashboard: Once logged in, locate your personal dashboard or account settings area. This section typically contains all account-specific information, including API keys.
3. Locate API Key: Within the dashboard, there should be a dedicated section for API access or developer settings. Your unique API key will be displayed here. It's usually a long string of alphanumeric characters.
4. Copy Your Key: Securely copy this key. It is crucial to treat your API key as a sensitive credential, similar to a password. Do not hardcode it directly into client-side code that could be publicly exposed, and avoid committing it to version control systems without proper encryption or environment variable management.

The Non-Working Days API documentation provides specific instructions and best practices for managing your API key once it has been generated. It is recommended to familiarize yourself with these guidelines to ensure the security of your integration.

Authenticated request example

When making requests to the Non-Working Days API, your API key must be included for authentication. The most common method is to pass the key as a query parameter named key in your API request URL. The Non-Working Days API is RESTful, making it straightforward to integrate using standard HTTP clients.

Here are examples demonstrating how to include your API key in requests using cURL, Python, and JavaScript:

cURL Example

The cURL command-line tool is often used for testing API endpoints. Replace YOUR_API_KEY with your actual Non-Working Days API key.

curl "https://api.nonworkingdays.com/v1/holidays?country=US&year=2026&key=YOUR_API_KEY"

Python Example

Using the requests library in Python, you can easily construct an authenticated request:

import requests

api_key = "YOUR_API_KEY"
country_code = "US"
year = 2026

url = f"https://api.nonworkingdays.com/v1/holidays?country={country_code}&year={year}&key={api_key}"

response = requests.get(url)

if response.status_code == 200:
    data = response.json()
    print(data)
else:
    print(f"Error: {response.status_code} - {response.text}")

JavaScript (Fetch API) Example

For client-side or Node.js applications, the Fetch API (or a library like Axios) can be used. Note that for client-side applications, it's generally recommended to proxy requests through your own backend to avoid exposing API keys directly in the browser.

const apiKey = "YOUR_API_KEY";
const countryCode = "US";
const year = 2026;

const url = `https://api.nonworkingdays.com/v1/holidays?country=${countryCode}&year=${year}&key=${apiKey}`;

fetch(url)
  .then(response => {
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    return response.json();
  })
  .then(data => {
    console.log(data);
  })
  .catch(error => {
    console.error("There was a problem with the fetch operation:", error);
  });

These examples demonstrate the fundamental method of including your API key in requests. Always refer to the Non-Working Days official API documentation for the most up-to-date and comprehensive examples.

Security best practices

Securing your API keys is crucial to prevent unauthorized access to your Non-Working Days account and to protect your API usage quota from malicious activity. Here are several security best practices to follow:

1. Do Not Expose API Keys in Client-Side Code: Never embed your API key directly into client-side code (e.g., JavaScript in a web browser or mobile application code) that could be reverse-engineered or viewed publicly. If your application needs to access the API from the client, consider implementing a backend proxy server that makes the requests to Non-Working Days on behalf of your client, adding an additional layer of security.
2. Use Environment Variables: For server-side applications, store your API key in environment variables rather than hardcoding it directly into your application's source code. This practice prevents the key from being committed to version control systems and makes it easier to manage different keys for different environments (development, staging, production). For instance, in Node.js, you might use process.env.NONWORKINGDAYS_API_KEY.
3. Restrict API Key Access: Limit who has access to your API keys within your organization. Only individuals who require direct access for development or operational purposes should know the keys.
4. Implement IP Whitelisting (if available): Check if Non-Working Days offers IP whitelisting capabilities. If so, configure your API key to only accept requests originating from a predefined list of trusted IP addresses. This significantly reduces the risk of unauthorized use if your key is compromised.
5. Monitor API Usage: Regularly monitor your API usage through your Non-Working Days account dashboard. Unusual spikes in requests could indicate that your API key has been compromised.
6. Key Rotation: Periodically rotate your API keys. This involves generating a new key and updating all your applications to use the new key, then revoking the old one. This practice limits the window of opportunity for a compromised key to be exploited. Consult the Non-Working Days API documentation for instructions on key rotation.
7. Revoke Compromised Keys Immediately: If you suspect an API key has been compromised, revoke it immediately from your Non-Working Days account dashboard. Replace it with a new key and update your applications accordingly.
8. Secure Development Practices: Adopt general secure coding practices, such as input validation and error handling, to prevent vulnerabilities that could indirectly expose credentials or lead to other security issues. The Mozilla Developer Network web security documentation offers comprehensive guidance on secure development.