OpenAQ Authentication: API Key Setup & Security (2026)

Authentication overview

The OpenAQ API provides programmatic access to a global dataset of real-time and historical air quality information. Authentication for the OpenAQ API is primarily managed through the use of API keys. These keys serve to identify the user or application making requests, enabling OpenAQ to enforce usage policies, manage rate limits, and differentiate between various service tiers, such as the free Community Plan and paid subscriptions like the Developer Plan OpenAQ pricing details. All API interactions, including the transmission of API keys, are secured using HTTPS/TLS to protect data in transit.

The authentication process is designed to be straightforward, requiring developers to include their unique API key with each request to the API. This mechanism allows OpenAQ to track consumption and ensure fair resource allocation across its user base. Proper management and secure handling of API keys are critical to prevent unauthorized access to your account's allocated resources and data.

Supported authentication methods

OpenAQ exclusively utilizes API keys as its authentication method for accessing the API. This approach simplifies integration while providing necessary security and usage tracking capabilities. API keys are long, randomly generated strings that act as a secret token, verifying the identity of the client application.

API Key

• Mechanism: The API key is typically sent in the Authorization header of HTTP requests, prefixed with Bearer, or as a query parameter. OpenAQ's documentation specifies the exact method of inclusion OpenAQ API reference.
• Purpose: To identify the calling application and authorize access based on the associated plan (e.g., Community, Developer).
• Security Considerations: API keys are secret credentials and should be treated with the same care as passwords. Exposure of an API key can lead to unauthorized usage of your OpenAQ account, potentially incurring costs or exceeding rate limits.

Authentication methods table

Getting your credentials

To obtain an API key for the OpenAQ API, you must register an account on the OpenAQ platform. The process typically involves:

1. Account Registration: Navigate to the OpenAQ website and sign up for a new account OpenAQ homepage. This usually requires providing an email address and creating a password.
2. Plan Selection: Choose a suitable plan. For non-commercial use, the Community Plan offers a free tier with an associated API key. Commercial or higher-volume usage will require subscribing to a paid plan, such as the Developer Plan, which provides increased rate limits and additional features OpenAQ billing documentation.
3. API Key Generation: Once your account is active and a plan is selected, log in to your OpenAQ dashboard. Within the dashboard, there will be a section dedicated to API keys, where you can generate or retrieve your unique key. The exact location may vary, but it is commonly found under "API Settings," "Developer Settings," or a similar section OpenAQ documentation portal.
4. Key Management: The dashboard also typically provides options to revoke existing keys or generate new ones, which is a crucial security practice if a key is suspected of being compromised.

It is important to store your API key securely immediately after generation. Avoid hardcoding it directly into client-side code or public repositories.

Authenticated request example

Once you have obtained your API key, you can include it in your API requests. OpenAQ typically expects the API key to be passed in the Authorization header using the Bearer scheme.

Python example using requests library

import requests

# Replace with your actual OpenAQ API Key
OPENAQ_API_KEY = "YOUR_OPENAQ_API_KEY"

headers = {
    "accept": "application/json",
    "Authorization": f"Bearer {OPENAQ_API_KEY}"
}

# Example endpoint: fetch latest air quality data
url = "https://api.openaq.org/v2/latest"

try:
    response = requests.get(url, headers=headers)
    response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
    data = response.json()
    print("Successfully fetched data:")
    # Process the data as needed
    # print(data)
except requests.exceptions.HTTPError as err:
    print(f"HTTP error occurred: {err}")
except requests.exceptions.RequestException as err:
    print(f"An error occurred: {err}")

cURL example

curl -X GET "https://api.openaq.org/v2/latest" \
     -H "accept: application/json" \
     -H "Authorization: Bearer YOUR_OPENAQ_API_KEY"

In both examples, YOUR_OPENAQ_API_KEY should be replaced with the actual API key generated from your OpenAQ account. The Authorization: Bearer header is the standard way to send an OAuth 2.0 access token, and OpenAQ adopts this convention for its API keys OAuth 2.0 specification.

Security best practices

Securing your OpenAQ API key is essential to prevent unauthorized access and potential misuse of your account's resources. Adhering to general API key security best practices will mitigate risks.

• Environment Variables: Store API keys as environment variables on your server or local development machine. This prevents them from being committed into source control systems like Git and makes them easily configurable across different environments.
• Secret Management Services: For production environments, consider using dedicated secret management services like AWS Secrets Manager AWS Secrets Manager documentation, Google Secret Manager Google Cloud Secret Manager overview, or Azure Key Vault Azure Key Vault overview. These services securely store, manage, and retrieve API keys and other sensitive credentials.
• Do Not Hardcode: Never hardcode API keys directly into your application's source code, especially in client-side applications (e.g., JavaScript in a browser) where they can be easily exposed.
• HTTPS/TLS Enforcement: Always ensure that all API requests are made over HTTPS. OpenAQ enforces HTTPS for all API endpoints, which encrypts the communication channel and protects your API key from interception during transit.
• Restrict IP Addresses: If OpenAQ supports it (check the API key management section in your dashboard), restrict the API key's usage to specific IP addresses or ranges. This ensures that even if a key is compromised, it can only be used from authorized locations.
• Regular Key Rotation: Periodically rotate your API keys. If a key is compromised, rotating it minimizes the window of exposure. OpenAQ's dashboard should provide functionality to generate new keys and revoke old ones.
• Monitor Usage: Regularly review your API usage logs and billing statements in the OpenAQ dashboard. Unusual spikes in usage could indicate a compromised key or an issue with your application.
• Least Privilege: If OpenAQ introduces granular permissions for API keys in the future, always assign the minimum necessary permissions to each key required for its specific task.