OpenCorporates Authentication: API Key Guide (2026)

Authentication overview

The OpenCorporates API employs a straightforward authentication mechanism based on API keys. This method is designed to provide secure access to its extensive dataset of company information, supporting various use cases such as due diligence, supply chain analysis, and investigative journalism. An API key acts as a unique token that identifies the calling application or user, granting access to specific API endpoints and data based on the associated subscription plan.

When making a request to the OpenCorporates API, this key must be included in the request URL. The API then validates the key against its records to ensure the request is authorized. This system allows OpenCorporates to manage usage limits, enforce rate limiting, and maintain the security of its data. Developers are responsible for safeguarding their API keys to prevent unauthorized access and potential misuse, as outlined in the OpenCorporates API documentation.

While API keys are effective for server-side applications and internal tools, they require careful handling, especially in client-side environments, due to their potential for exposure. For detailed information on API usage and best practices, refer to the official OpenCorporates API documentation.

Supported authentication methods

OpenCorporates primarily supports API key authentication for accessing its data. This method is widely used across various APIs for its simplicity and effectiveness in controlling access to resources. The API key is a unique string that you obtain from your OpenCorporates account dashboard after registration. This key is then appended to your API requests, typically as a query parameter.

The API key mechanism is suitable for most integration scenarios, particularly those involving server-to-server communication where the key can be securely stored and managed. It allows OpenCorporates to identify the source of each request and apply the appropriate access policies and rate limits based on your subscription level. OpenCorporates offers a free tier that includes up to 1,000 API calls per month, with paid plans available for higher volumes starting at $150 per month for 50,000 calls.

Authentication method table

API keys are a common authentication mechanism, but their security relies heavily on how they are managed. For instance, OAuth 2.0, a more complex but robust framework, is often preferred for user-facing applications requiring delegated authorization without exposing user credentials directly. However, OpenCorporates's focus on structured company data access for developers and businesses simplifies the authentication process to API keys, streamlining integration for its target audience.

Getting your credentials

To obtain your OpenCorporates API key, you must first register for an account on the OpenCorporates website. The process typically involves creating a user account and then navigating to a dedicated API section or dashboard to generate your key. Here's a general outline of the steps:

1. Register for an OpenCorporates account: Visit the OpenCorporates homepage and sign up for a new account.
2. Access your account dashboard: After successful registration and login, navigate to your personal dashboard or account settings area.
3. Locate the API section: Look for a section explicitly labeled "API Access," "Developer Settings," or similar.
4. Generate your API key: Within the API section, there should be an option to generate a new API key. Follow the prompts to create your unique key.
5. Copy and store your key securely: Once generated, your API key will be displayed. Copy this key immediately and store it in a secure location. It is crucial to treat your API key like a password, as anyone with access to it can make requests on your behalf.

OpenCorporates provides detailed instructions on their API documentation page regarding credential setup and usage. Ensure you review these instructions to understand any specific requirements or limitations associated with your API key and subscription plan.

Authenticated request example

Once you have obtained your API key, you can include it in your requests to the OpenCorporates API. The key is typically passed as a query parameter named api_token. Below are examples demonstrating how to make an authenticated request using common programming languages.

Python example

This Python example uses the requests library to query the OpenCorporates API for a company by its name, including the API token as a query parameter.

import requests
import json

API_KEY = "YOUR_API_KEY"
COMPANY_NAME = "Google LLC"

url = f"https://api.opencorporates.com/v0.4/companies/search?q={COMPANY_NAME}&api_token={API_KEY}"

try:
    response = requests.get(url)
    response.raise_for_status()  # Raise an HTTPError for bad responses (4xx or 5xx)
    data = response.json()
    print(json.dumps(data, indent=2))
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

Node.js example

This Node.js example uses the built-in https module to perform a similar query. For more complex applications, libraries like axios are often preferred.

const https = require('https');

const API_KEY = "YOUR_API_KEY";
const COMPANY_NAME = "Google LLC";

const options = {
  hostname: 'api.opencorporates.com',
  path: `/v0.4/companies/search?q=${encodeURIComponent(COMPANY_NAME)}&api_token=${API_KEY}`,
  method: 'GET'
};

const req = https.request(options, (res) => {
  let data = '';

  res.on('data', (chunk) => {
    data += chunk;
  });

  res.on('end', () => {
    try {
      console.log(JSON.parse(data));
    } catch (e) {
      console.error('Failed to parse JSON:', e);
    }
  });
});

req.on('error', (e) => {
  console.error(`Problem with request: ${e.message}`);
});

req.end();

Remember to replace "YOUR_API_KEY" with your actual API key before running these examples. For further examples and specific endpoint details, consult the OpenCorporates API documentation.

Security best practices

Securing your API keys is paramount to protect your data and prevent unauthorized usage of your OpenCorporates account. Adhering to these best practices can mitigate common security risks:

• Do not hardcode API keys: Avoid embedding API keys directly into your application's source code. Instead, use environment variables, configuration files, or a secrets management service to store and retrieve keys. This prevents exposure if your code repository is compromised.
• Use environment variables: For server-side applications, storing API keys as environment variables is a common and recommended practice. This keeps keys out of your codebase and allows for easy rotation without code changes.
• Restrict key access: Limit access to your API keys to only those individuals and systems that absolutely require it. Implement role-based access control (RBAC) where possible.
• Regularly rotate keys: Periodically generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. The frequency of rotation should be determined by your organization's security policies and risk assessment.
• Monitor API usage: Keep an eye on your API usage patterns within your OpenCorporates account dashboard. Unusual spikes or activity could indicate a compromised key.
• Avoid client-side exposure: Never expose your API key directly in client-side code (e.g., JavaScript in web browsers or mobile applications). If client-side access is necessary, consider implementing a proxy server that adds the API key on the server side before forwarding the request to OpenCorporates. This acts as a protective layer, as described in Cloudflare's guide on API key protection.
• Implement IP whitelisting (if available): If OpenCorporates offers IP whitelisting, configure your API key to only accept requests originating from a predefined set of trusted IP addresses. This adds an extra layer of security, making it harder for unauthorized parties to use your key even if they obtain it.
• Secure your development environment: Ensure that your development machines and build pipelines are secure. Malicious software or improper access controls in these environments could lead to key exposure.

By implementing these security measures, you can significantly reduce the risk of your OpenCorporates API key being compromised and ensure the integrity and confidentiality of your data interactions.