Authentication overview

Polygon's API authentication system is designed to provide secure and controlled access to its extensive market data feeds, including real-time and historical data for stocks, options, forex, and cryptocurrencies. The primary method for authenticating requests to Polygon's APIs involves the use of a unique API key. This key identifies the account making the request and determines the level of access based on the associated subscription plan.

When an API key is included with a request, Polygon's servers validate it against known active keys. A valid key grants access to the requested data, provided the account has the necessary permissions and rate limits are not exceeded. Invalid or missing API keys will result in an authentication failure, typically returning an HTTP 401 Unauthorized status code.

The system is built to be straightforward for developers, allowing for quick integration across various programming languages through query parameters. All API communication with Polygon is secured using HTTPS, encrypting data in transit and protecting API keys from interception during transmission, which is a standard practice for secure web communication as outlined by the World Wide Web Consortium's security guidelines.

Supported authentication methods

Polygon primarily supports a single, consistent authentication method across all its data APIs: the API key passed as a query parameter. This approach simplifies integration and ensures that developers can use the same authentication logic regardless of the specific market data endpoint they are accessing.

Method When to Use Security Level
API Key (Query Parameter) All API requests to Polygon for data retrieval. Standard. Requires secure storage and transmission over HTTPS.

The API key acts as a secret token, granting the bearer access to the associated account's data. Therefore, it is crucial to treat API keys with the same level of confidentiality as other sensitive credentials. While other authentication methods like OAuth 2.0 or JWTs offer different security models, the API key model is effective for service-to-service communication where a backend application or script makes direct API calls on behalf of a single developer account. For more general information on API key security, the Google Cloud documentation on API keys provides useful context.

Getting your credentials

To obtain an API key for Polygon, you must first register for an account on their platform. After successful registration and logging in, your API key will be available in your personal dashboard. The process generally involves the following steps:

  1. Sign Up/Log In: Navigate to the Polygon.io homepage and either sign up for a new account or log in to an existing one.
  2. Access Dashboard: Once logged in, you will be directed to your user dashboard.
  3. Locate API Key: Your unique API key is typically displayed prominently within the dashboard, often under a section like "API Key" or "Account Settings." Refer to the Polygon.io official documentation for specific instructions, as UI elements may change.

Polygon provides different tiers of access (e.g., Starter, Developer, Growth) with varying data availability and rate limits. Your API key will inherit the permissions and limitations of your current subscription plan. It is important to note that API keys are tied to your account and should not be shared or embedded directly into client-side code where they could be easily extracted by end-users.

Authenticated request example

After obtaining your API key, you will include it as a query parameter in every request to Polygon's REST API endpoints. The parameter name for the API key is consistently apiKey. Below are examples demonstrating how to make an authenticated request using common programming languages and command-line tools.

Python example

Using the requests library in Python to fetch stock data:


import requests
import os

API_KEY = os.environ.get("POLYGON_API_KEY") # It's best practice to load API keys from environment variables
STOCK_TICKER = "AAPL"

if API_KEY:
    url = f"https://api.polygon.io/v2/aggs/ticker/{STOCK_TICKER}/range/1/day/2023-01-09/2023-01-09?apiKey={API_KEY}"
    response = requests.get(url)

    if response.status_code == 200:
        data = response.json()
        print(data)
    else:
        print(f"Error: {response.status_code} - {response.text}")
else:
    print("POLYGON_API_KEY environment variable not set.")

Node.js example

Using fetch in Node.js:


const fetch = require('node-fetch'); // For older Node.js versions, native fetch is available in newer versions

const API_KEY = process.env.POLYGON_API_KEY; // Load from environment variables
const STOCK_TICKER = 'MSFT';

async function getStockData() {
  if (!API_KEY) {
    console.error('POLYGON_API_KEY environment variable not set.');
    return;
  }

  const url = `https://api.polygon.io/v2/aggs/ticker/${STOCK_TICKER}/range/1/day/2023-01-09/2023-01-09?apiKey=${API_KEY}`;

  try {
    const response = await fetch(url);
    const data = await response.json();

    if (response.ok) {
      console.log(data);
    } else {
      console.error(`Error: ${response.status} - ${data.message || response.statusText}`);
    }
  } catch (error) {
    console.error('Fetch error:', error);
  }
}

getStockData();

cURL example

Making a request from the command line:


API_KEY="YOUR_POLYGON_API_KEY" # Replace with your actual API key or load from env var
STOCK_TICKER="GOOG"

curl -X GET "https://api.polygon.io/v2/aggs/ticker/${STOCK_TICKER}/range/1/day/2023-01-09/2023-01-09?apiKey=${API_KEY}"

For more detailed API references and additional examples across various programming languages, consult the Polygon Stocks API Getting Started Guide.

Security best practices

Securing your Polygon API keys is critical to preventing unauthorized access to your account and data. Adhering to robust security practices is essential:

  • Environment Variables: Never hardcode API keys directly into your source code. Instead, load them from environment variables (e.g., POLYGON_API_KEY). This practice keeps sensitive credentials out of version control systems and allows for easy rotation without code changes.
  • Server-Side Usage Only: Polygon API keys grant access to your account's data and should only be used in server-side applications or secure backend environments. Exposing API keys in client-side code (e.g., JavaScript in a web browser, mobile apps) makes them vulnerable to extraction by malicious users. All requests to Polygon should originate from your secure backend.
  • Strict Network Policies: If possible, restrict network access for applications using your API key. Implement firewall rules or VPC security groups to limit outbound connections from your servers only to necessary endpoints, such as api.polygon.io.
  • Regular Key Rotation: Periodically generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. Check your Polygon dashboard for options to generate new keys and disable existing ones.
  • Monitor API Usage: Regularly review your API usage patterns within the Polygon dashboard. Unusual spikes in requests or access from unexpected locations could indicate a compromised key.
  • Secure Storage: If you must store API keys in configuration files, ensure these files are encrypted at rest and their access is strictly controlled. Avoid storing them in plain text on publicly accessible servers or repositories.
  • HTTPS Enforcement: All communication with Polygon's API is mandated over HTTPS. Ensure your client applications strictly enforce HTTPS for all requests to prevent man-in-the-middle attacks where an attacker could intercept your API key during transmission. This is a fundamental principle of secure web contexts.
  • Error Handling: Implement robust error handling for API requests. Specifically, handle 401 Unauthorized responses gracefully, but avoid logging the API key in error messages, which could expose it.
  • Least Privilege: If Polygon offered different types of API keys with varying permissions (e.g., read-only vs. read-write), always use the key with the minimum necessary privileges for the task at hand. While Polygon primarily uses a single key type for data access, this is a general security principle.