PM25.in Authentication: API Key Setup and Best Practices (2026)

Authentication overview

Authentication for the PM25.in API is a foundational security measure that verifies the identity of a client attempting to access its resources. By confirming who is making a request, PM25.in can authorize access, enforce rate limits, and ensure data integrity and security. For PM25.in, this process primarily involves the use of API keys, a common and straightforward method for controlling access to web services.

An API key acts as a unique identifier and a secret token that clients must include with their requests. When a request reaches the PM25.in server, the system checks the provided API key against its records. If the key is valid and associated with an active account, the request is processed; otherwise, it is rejected. This mechanism helps PM25.in manage access to its real-time and historical air quality data endpoints, ensuring that only authenticated users consume the API resources according to their subscription tiers, which range from a free tier starting at 5000 requests/day to paid tiers with higher volumes PM25.in API pricing details. Understanding the role of API keys is crucial for developers integrating PM25.in data into applications, as it directly impacts the ability to fetch and utilize the air quality information.

Supported authentication methods

PM25.in primarily supports API key-based authentication. This method is widely adopted for its simplicity and effectiveness in controlling access to web APIs. An API key is a string of characters that uniquely identifies a user or application when making requests to an API. It functions as both an identifier and a secret token, allowing the API provider to authenticate the request origin and apply access policies, such as rate limits and permissions.

While API keys are suitable for many use cases, developers should be aware of their security implications. Unlike more complex authentication schemes like OAuth 2.0, API keys do not inherently provide mechanisms for user consent or granular permission management beyond basic access control Google Cloud API key security documentation. For PM25.in, the API key is typically passed as a query parameter or a custom HTTP header with each API request. The documentation for PM25.in outlines the specific method for including the API key, which ensures that each request is properly attributed and authorized PM25.in API reference.

Authentication methods summary

Getting your credentials

To obtain the necessary credentials for authenticating with the PM25.in API, you must first register for an account on the PM25.in platform. The process typically involves a few steps:

1. Visit the PM25.in API page: Navigate to the PM25.in API section of their website. This page provides information on API features, pricing, and how to get started.
2. Sign Up or Log In: If you don't already have an account, you will need to sign up. This usually involves providing an email address and creating a password. If you have an existing account, simply log in.
3. Access Your API Key: Once logged in, your API key will typically be displayed on your dashboard or a dedicated API section within your account settings. PM25.in generates a unique API key for each user upon registration. It is crucial to locate and securely store this key, as it is your primary means of authenticating API requests.
4. Understand Usage Tiers: Familiarize yourself with the various API usage tiers available. PM25.in offers a free tier that allows up to 5000 requests per day, and paid tiers that provide higher request volumes, starting at 10000 requests/day for 2000 INR/month PM25.in pricing information. Your API key will be associated with your chosen tier, dictating your rate limits.

It is important to treat your API key as a sensitive credential. Do not hardcode it directly into client-side code, commit it to version control systems like Git, or expose it in publicly accessible client-side applications. Best practices for securing your API key are discussed in the security best practices section.

Authenticated request example

To make an authenticated request to the PM25.in API, you will typically include your API key as a query parameter in the URL. Below is an example using a hypothetical endpoint for fetching real-time air quality data for a specific city, demonstrating how the api_key parameter is appended to the request URL. This example uses curl, a common command-line tool for making HTTP requests.

Example: Fetching real-time air quality data for Delhi

curl "https://api.pm25.in/data/delhi?api_key=YOUR_API_KEY_HERE"

In this example:

• https://api.pm25.in/data/delhi is the base API endpoint for retrieving data for Delhi.
• ?api_key=YOUR_API_KEY_HERE is the query parameter where you replace YOUR_API_KEY_HERE with your actual API key obtained from your PM25.in account.

Upon successful authentication and a valid request, the API will return a JSON response containing the requested air quality data. An unsuccessful request, such as one with an invalid or missing API key, will typically result in an HTTP error code (e.g., 401 Unauthorized or 403 Forbidden) and an error message.

Developers implementing this in various programming languages would construct the URL similarly. For instance, in Python with the requests library:

import requests

api_key = "YOUR_API_KEY_HERE"
city = "delhi"
url = f"https://api.pm25.in/data/{city}"

params = {
    "api_key": api_key
}

response = requests.get(url, params=params)

if response.status_code == 200:
    data = response.json()
    print("Air quality data for Delhi:", data)
else:
    print(f"Error: {response.status_code} - {response.text}")

This Python example demonstrates how to pass the API key as a dictionary of parameters, which the requests library then properly encodes into the URL query string.

Security best practices

Securing your API keys is paramount to prevent unauthorized access to your PM25.in account and data, as well as to protect against potential abuse that could lead to unexpected charges or service interruptions. Adhering to these best practices will help maintain the integrity and security of your integration:

1. Keep API Keys Confidential: Treat your API key as a password. Never share it publicly, commit it to version control systems (like Git repositories), or embed it directly in client-side code (e.g., JavaScript in web pages or mobile apps) where it could be easily extracted.
2. Use Environment Variables: For server-side applications, store your API key in environment variables rather than hardcoding it. This practice keeps the key out of your codebase and allows for easier management and rotation. Most operating systems and deployment platforms support environment variables.
3. Restrict Access to API Keys: Limit who has access to your API keys within your development team. Implement role-based access control where possible, ensuring that only necessary personnel can retrieve or modify keys.
4. Avoid Hardcoding in Client-Side Code: If your application runs on a user's device (e.g., a web browser or mobile app), direct API calls using a public API key are risky. Consider using a proxy server to route requests, where your server makes the actual API call to PM25.in using its securely stored API key. The client then communicates with your proxy.
5. Implement Rate Limiting and Monitoring: Even with a secure API key, malicious actors might attempt brute-force attacks. Implement your own rate limiting on your application's side to prevent excessive calls to PM25.in. Monitor your API usage dashboard on PM25.in for any unusual activity.
6. Rotate API Keys Regularly: Periodically rotate your API keys, especially if you suspect a key might have been compromised. PM25.in's platform should offer a mechanism to revoke old keys and generate new ones.
7. Secure Your Development Environment: Ensure that your development and deployment environments are secure. This includes using strong passwords, enabling multi-factor authentication for developer accounts, and keeping software up-to-date to patch known vulnerabilities.
8. Use HTTPS for All Communications: All communication with the PM25.in API should occur over HTTPS to encrypt data in transit. This prevents eavesdropping and tampering with your API key and the data being exchanged. The PM25.in API inherently uses HTTPS PM25.in API documentation, but it's important to ensure your client applications are configured to enforce this.

By following these best practices, you can significantly reduce the risk of your PM25.in API key being compromised and ensure a secure integration with the air quality data service.