Open Government, Mexico Authentication: API Access (2026)

Authentication overview

Open Government, Mexico provides various APIs and datasets designed to enhance transparency and foster civic engagement. To ensure secure and controlled access to these resources, developers must authenticate their requests. The authentication mechanisms are designed to protect both the integrity of the data and the security of the systems providing it, aligning with the principles outlined in the Open Government, Mexico official documentation.

Authentication for Open Government, Mexico APIs primarily relies on standard web authentication protocols, ensuring broad compatibility and ease of integration for developers. The specific method required can vary depending on the API or dataset being accessed, with simpler public datasets often requiring API keys and more sensitive or user-specific services potentially utilizing OAuth 2.0 for delegated authorization. All API interactions are expected to occur over secure channels (HTTPS/TLS) to encrypt data in transit and prevent eavesdropping or tampering.

When integrating with Open Government, Mexico APIs, developers should anticipate managing credentials securely, adhering to rate limits, and implementing robust error handling. The authentication process is a prerequisite for making successful API calls and is central to maintaining the security posture of both the developer's application and the government's open data initiatives.

Supported authentication methods

Open Government, Mexico supports two primary authentication methods for its APIs:

1. API Keys: This is the most common and straightforward method for accessing many of the public datasets and general information APIs. An API key is a unique string of characters that identifies the calling application or user. It is typically passed as a query parameter or a custom HTTP header with each request. API keys provide a simple way to track usage and control access, but they do not provide user-specific authorization.
2. OAuth 2.0: For services that require user consent or delegated access to user-specific data, Open Government, Mexico employs the OAuth 2.0 authorization framework. OAuth 2.0 allows an application to obtain limited access to a user's account on an HTTP service, such as the Open Government, Mexico portal, without giving away the user's password. This method is suitable for applications that need to perform actions on behalf of a user, such as submitting feedback or accessing personalized government services. The OAuth 2.0 specification is a widely adopted industry standard for authorization.

Authentication methods comparison

Getting your credentials

To obtain the necessary authentication credentials for Open Government, Mexico APIs, follow these steps:

1. Visit the Gobierno Abierto Developer Portal: Navigate to the official Open Government, Mexico documentation portal. This portal serves as the primary resource for developers, providing API specifications, documentation, and information on credential acquisition.
2. Register an Application: Depending on the specific API, you may need to register your application within the developer portal. This process typically involves providing details about your application, such as its name, description, and redirection URIs (for OAuth 2.0 flows). Upon registration, the system will generate your API key or client ID/client secret pair.
3. Retrieve API Key: For API Key-based authentication, your API key will be displayed immediately after application registration or can be found in your developer dashboard. Treat this key as a secret.
4. Configure OAuth 2.0 Credentials: If using OAuth 2.0, you will receive a Client ID and Client Secret. These are essential for initiating the OAuth flow. The Client ID identifies your application, and the Client Secret is used to authenticate your application when exchanging authorization codes for access tokens. Configure your application's redirect URIs carefully within the portal to ensure secure token delivery.
5. Review API-Specific Instructions: Always consult the documentation for the specific API you intend to use, as there might be additional steps or specific parameters required for authentication.

Authenticated request example

This section provides examples of authenticated requests for both API Key and OAuth 2.0 methods. For these examples, we assume a hypothetical API endpoint https://api.gob.mx/v1/data/datasets.

API Key example

When using an API Key, it is typically passed as a query parameter or a custom HTTP header. Passing it as a header is generally recommended for better security, as it avoids exposing the key in server logs or browser history.

Passing API Key as a query parameter (less recommended):

GET /v1/data/datasets?api_key=YOUR_API_KEY_HERE HTTP/1.1
Host: api.gob.mx

Passing API Key as an HTTP header (recommended):

GET /v1/data/datasets HTTP/1.1
Host: api.gob.mx
X-API-Key: YOUR_API_KEY_HERE

Replace YOUR_API_KEY_HERE with your actual API key obtained from the developer portal.

OAuth 2.0 example (Client Credentials Grant)

For server-to-server communication where no user interaction is involved, the Client Credentials Grant flow can be used to obtain an access token. This example assumes you have a Client ID and Client Secret.

Step 1: Obtain an Access Token

POST /oauth/token HTTP/1.1
Host: api.gob.mx
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET

The response will contain an access_token and its expires_in duration, among other fields.

{
  "access_token": "YOUR_ACCESS_TOKEN_HERE",
  "token_type": "bearer",
  "expires_in": 3600
}

Step 2: Make an authenticated request with the Access Token

Once you have the access token, include it in the Authorization header of your API requests.

GET /v1/data/datasets HTTP/1.1
Host: api.gob.mx
Authorization: Bearer YOUR_ACCESS_TOKEN_HERE

Replace YOUR_CLIENT_ID, YOUR_CLIENT_SECRET, and YOUR_ACCESS_TOKEN_HERE with your actual credentials and the obtained token.

Security best practices

Adhering to security best practices is crucial when implementing authentication for Open Government, Mexico APIs to protect your application, user data, and the government's services. These practices align with general API security guidelines recommended by organizations like the IETF in RFC 6819 for OAuth 2.0 Threat Model and Security Considerations.

• Protect your API Keys and Client Secrets:
• Never hardcode API keys or client secrets directly into your application's source code. Use environment variables, configuration files, or secure credential management systems.
• Do not expose API keys or client secrets in public repositories (e.g., GitHub).
• Rotate API keys regularly, especially if there's any suspicion of compromise.
• Use HTTPS/TLS for all communications:
• Always ensure that all API requests are made over HTTPS (HTTP Secure). This encrypts the communication channel, protecting sensitive data like API keys, tokens, and request/response bodies from interception. Open Government, Mexico APIs enforce HTTPS.
• Verify SSL/TLS certificates to prevent man-in-the-middle attacks.
• Implement secure OAuth 2.0 flows:
• For public or single-page applications, prefer flows like Authorization Code with PKCE (Proof Key for Code Exchange) to mitigate authorization code interception attacks.
• Carefully manage redirect URIs; register only specific, secure URIs with the API provider.
• Store refresh tokens securely, ideally encrypted, and revoke them if compromised.
• Handle tokens securely:
• Store access tokens in memory or secure, short-lived storage. Avoid storing them in local storage (web browsers) due to XSS vulnerabilities.
• Validate tokens received from the authorization server to ensure their authenticity and integrity (e.g., check signature, issuer, audience, expiry).
• Implement rate limiting and error handling:
• Be aware of and respect API rate limits to avoid getting blocked.
• Implement robust error handling to gracefully manage authentication failures and network issues without exposing sensitive information.
• Principle of Least Privilege: Request only the minimum necessary permissions (scopes) when using OAuth 2.0. This limits the potential damage if a token is compromised.
• Regular Audits and Monitoring: Regularly audit your application's authentication implementation and monitor for any unusual activity or access patterns.