Onyx Bazaar Authentication: API Keys & Security Best Practices (2026)

Authentication overview

Onyx Bazaar secures access to its suite of data products, including the Onyx Data Lake, Onyx Query Engine, and Onyx Data Catalog, primarily through API key authentication. This mechanism allows developers and applications to interact with the Onyx Bazaar API by providing a unique, secret key with each request. The use of API keys is a common practice for authenticating client applications accessing web services, offering a straightforward approach to identifying and authorizing requests as described by Google Cloud. Onyx Bazaar's authentication system is designed to be developer-friendly, integrating seamlessly across various programming languages and environments, including official SDKs for Python, JavaScript, and Go.

All communication with the Onyx Bazaar API must occur over HTTPS, ensuring that API keys and data payloads are encrypted during transit. This adherence to Transport Layer Security (TLS) protocols helps protect against eavesdropping and tampering, contributing to the overall security posture of integrations built on Onyx Bazaar as recommended by Cloudflare. Users are responsible for managing their API keys securely, preventing unauthorized access to their Onyx Bazaar resources and data.

The authentication process typically involves:

1. Generating an API key from the Onyx Bazaar account dashboard.
2. Including the API key in the header or query parameters of API requests.
3. The Onyx Bazaar API validating the key before processing the request.

Supported authentication methods

Onyx Bazaar focuses on API key authentication as its primary and currently supported method for accessing its public data and analytics services. This approach offers simplicity and ease of integration for server-to-server communication and client applications. While API keys are the default, the platform's design allows for granular control over key permissions and lifecycle management, enhancing security when implemented correctly.

For scenarios requiring more advanced authentication flows, such as user consent or delegated access for third-party applications, developers should consider implementing an intermediary service that handles API key access securely. This service would act as a proxy, authenticating users and then using its own securely stored Onyx Bazaar API key to make requests on their behalf.

Getting your credentials

To begin authenticating with the Onyx Bazaar API, you first need to obtain an API key. This key serves as your primary credential for accessing and interacting with the data platform. The process is straightforward and managed through your Onyx Bazaar account dashboard.

API Key Generation

1. Account Creation/Login: If you don't already have one, create an account on the Onyx Bazaar homepage. Existing users can log directly into their dashboard.
2. Navigate to API Settings: Once logged in, locate the "API Keys" or "Developer Settings" section within your account dashboard. The exact navigation may vary, but it is typically found under a profile or settings menu. Consult the Onyx Bazaar documentation for precise instructions.
3. Generate New Key: Click the "Generate New API Key" button. You may be prompted to provide a name or description for the key, which can help you identify its purpose later (e.g., "Python data script", "Web app backend").
4. Store Your Key Securely: After generation, your API key will be displayed. It is crucial to copy this key immediately and store it in a secure location. For security reasons, Onyx Bazaar typically only displays the full key once, and you will not be able to retrieve it again if lost. If lost, you will need to generate a new one and revoke the old one.
5. Configure Permissions (Optional): Depending on your plan and the specific features, you might have options to configure permissions or scopes for your API key, limiting its access to certain data sets or operations. Review the Onyx Bazaar API reference for details on available permissions.

Key Management

• Key Rotation: Regularly rotate your API keys by generating a new key, updating your applications to use the new key, and then revoking the old key. This practice minimizes the window of exposure if a key is compromised.
• Key Revocation: If a key is compromised or no longer needed, revoke it immediately from your Onyx Bazaar dashboard. Revocation instantly invalidates the key, preventing further unauthorized access.

Authenticated request example

This section demonstrates how to make an authenticated request to the Onyx Bazaar API using an API key. Examples are provided for Python and JavaScript, leveraging the official SDKs where applicable, or standard HTTP client libraries.

Python Example

Using the Onyx Bazaar Python SDK:

import os
from onyx_bazaar import Client

# It's best practice to load your API key from environment variables
ONYX_API_KEY = os.environ.get("ONYX_BAZAAR_API_KEY")

if not ONYX_API_KEY:
    raise ValueError("ONYX_BAZAAR_API_KEY environment variable not set.")

# Initialize the client with your API key
client = Client(api_key=ONYX_API_KEY)

try:
    # Example: Fetching data from a specific dataset
    dataset_id = "example-dataset-xyz"
    query_params = {"limit": 10, "offset": 0}
    data = client.data.get(dataset_id, **query_params)
    print("Successfully fetched data:")
    for item in data:
        print(item)
except Exception as e:
    print(f"An error occurred: {e}")

JavaScript Example

Using the Onyx Bazaar JavaScript SDK (Node.js environment):

import { OnyxBazaarClient } from '@onyxbazaar/sdk';

const ONYX_API_KEY = process.env.ONYX_BAZAAR_API_KEY;

if (!ONYX_API_KEY) {
    throw new Error("ONYX_BAZAAR_API_KEY environment variable not set.");
}

const client = new OnyxBazaarClient({ apiKey: ONYX_API_KEY });

async function fetchData() {
    try {
        const datasetId = "example-dataset-xyz";
        const queryParams = { limit: 10, offset: 0 };
        const data = await client.data.get(datasetId, queryParams);
        console.log("Successfully fetched data:", data);
    } catch (error) {
        console.error("An error occurred:", error.message);
    }
}

fetchData();

cURL Example (Direct HTTP Request)

For direct HTTP requests without an SDK, you typically pass the API key in a custom HTTP header or as a query parameter, depending on the API's design. The Onyx Bazaar API reference specifies the exact method, but a common pattern is an X-API-Key header:

curl -X GET \
  "https://api.onyxbazaar.com/v1/data/example-dataset-xyz?limit=10" \
  -H "Accept: application/json" \
  -H "X-API-Key: YOUR_ONYX_BAZAAR_API_KEY"

Replace YOUR_ONYX_BAZAAR_API_KEY with your actual API key and adjust the dataset ID and query parameters as needed.

Security best practices

Implementing strong security practices is paramount when working with API keys to protect your data and prevent unauthorized access to your Onyx Bazaar account. Adhering to these guidelines ensures the integrity and confidentiality of your integrations.

• Environment Variables for API Keys: Never hardcode API keys directly into your source code. Instead, load them from environment variables (e.g., ONYX_BAZAAR_API_KEY). This practice keeps sensitive credentials out of version control and build artifacts, making them easier to manage and rotate.
• Access Control and Least Privilege: If Onyx Bazaar supports granular permissions for API keys, assign only the minimum necessary permissions required for a specific application or service. For instance, a key used only for reading data should not have write or delete privileges.
• IP Whitelisting: If supported by Onyx Bazaar, restrict API key usage to a predefined list of trusted IP addresses. This measure significantly reduces the risk of unauthorized access even if a key is compromised, as requests from non-whitelisted IPs will be rejected.
• Regular Key Rotation: Implement a policy to regularly rotate your API keys. This means generating a new key, updating all applications to use the new key, and then revoking the old key. The frequency of rotation depends on your organization's security policies and risk assessment.
• Secure Storage: Store API keys securely. For server-side applications, use secure configuration management systems or secrets managers (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). Avoid storing keys in plain text files or publicly accessible locations.
• Monitor API Usage: Regularly review API usage logs and metrics provided by Onyx Bazaar. Unusual patterns, high error rates, or unexpected data access attempts could indicate a compromised key or malicious activity.
• Error Handling: Implement robust error handling in your applications. Avoid logging API keys or sensitive authentication details in error messages or application logs, as this could inadvertently expose them.
• HTTPS/TLS Enforcement: Always ensure that all API communications occur over HTTPS. Onyx Bazaar mandates HTTPS for all API interactions, but it's essential to verify your client applications are configured to enforce this as well. This encrypts data in transit, protecting against man-in-the-middle attacks.
• Client-Side Exposure: Do not use API keys directly in client-side code (e.g., frontend JavaScript running in a browser) unless the key is specifically designed for public use and has extremely limited permissions. For client-side applications requiring access to protected resources, use an intermediary backend service to manage and secure API key access.
• Incident Response Plan: Have a plan in place for what to do if an API key is suspected to be compromised. This should include immediate revocation of the key, investigation of potential breaches, and generation of new credentials.

By following these best practices, developers can significantly enhance the security of their applications integrating with Onyx Bazaar, protecting both their data and their users.