SpotSense Authentication: API Key Security & Management (2026)

Authentication overview

SpotSense secures access to its Geocoding, Reverse Geocoding, Autocomplete, Places, and IP Geolocation APIs through API key authentication. This method ensures that all requests made to the SpotSense platform are authorized and associated with a specific user account. API keys function as a unique identifier for your application, allowing SpotSense to monitor usage, enforce rate limits, and apply billing accurately. The system is designed to provide a straightforward yet secure way for developers to integrate location services into their applications while maintaining control over access.

When an authenticated request is made, the API key is transmitted with the request, typically as a query parameter or an HTTP header. SpotSense's backend then validates this key against its records. If the key is valid and active, the request is processed; otherwise, it is rejected. This mechanism helps prevent unauthorized access to your account's quota and data, making the API key a critical component of your application's security posture when interacting with SpotSense services. For detailed technical specifications, refer to the official SpotSense API reference documentation.

Supported authentication methods

SpotSense primarily utilizes API keys for authentication across all its services. This method is suitable for most application types, from server-side integrations to client-side JavaScript applications, though specific security considerations apply for each environment. The API key serves as a token that grants access to the SpotSense API endpoints.

API Key Authentication

API key authentication involves including a unique string, your API key, with every request to the SpotSense API. This key identifies your project and authorizes the request. It's a common and effective method for controlling access to web services due to its simplicity and ease of implementation. Developers should treat API keys as sensitive credentials and protect them from unauthorized exposure.

Table: SpotSense Authentication Methods

Getting your credentials

To obtain your SpotSense API key, you will typically follow a process within the SpotSense developer dashboard. This involves creating an account, setting up a project, and then generating the API key associated with that project. The key is usually displayed once upon generation, and it is crucial to record it securely as it may not be retrievable later.

1. Sign Up/Log In: Navigate to the SpotSense homepage and either sign up for a new account or log in to an existing one.
2. Create a Project: Within your dashboard, you will likely find an option to create a new project. Projects help organize your API usage and allow for separate key management.
3. Generate API Key: Once a project is created, locate the 'API Keys' or 'Credentials' section. Here, you can generate a new API key. SpotSense may allow you to name your key for easier management, especially if you plan to have multiple keys for different applications or environments (e.g., development, staging, production).
4. Configure Restrictions (Optional but Recommended): Depending on your application's needs, you might be able to add restrictions to your API key, such as HTTP referrer restrictions (for web applications) or IP address restrictions (for server-side applications). This enhances security by limiting where and by whom your key can be used.
5. Securely Store Your Key: Once generated, copy your API key and store it in a secure location. Avoid hardcoding it directly into your client-side code, especially for public-facing applications. For server-side applications, use environment variables or a secure configuration management system.

For specific, step-by-step instructions, always consult the most current SpotSense official documentation for API key management.

Authenticated request example

This section demonstrates how to make an authenticated request using a SpotSense API key. The examples show common methods for including the key in a request, suitable for both server-side and client-side implementations. Remember to replace YOUR_API_KEY with your actual SpotSense API key.

cURL Example (Query Parameter)

This example shows a basic GET request to the SpotSense Geocoding API, with the API key included as a query parameter. This method is often used for quick tests or in environments where the key's visibility is not a critical concern, but it is generally less secure for production server-side applications.

curl "https://api.spotsense.ai/v1/geocode?address=1600+Amphitheatre+Parkway,+Mountain+View,+CA&apiKey=YOUR_API_KEY"

Python Example (Query Parameter)

Using the Python requests library, the API key can be passed as part of the params dictionary, which automatically handles URL encoding. This is a common pattern for interacting with RESTful APIs in Python.

import requests

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://api.spotsense.ai/v1/geocode"

params = {
    "address": "Eiffel Tower, Paris",
    "apiKey": API_KEY
}

response = requests.get(BASE_URL, params=params)
data = response.json()
print(data)

JavaScript Example (Client-side, Query Parameter)

For client-side JavaScript applications, the API key is typically embedded directly in the request URL. When deploying client-side applications, it is strongly recommended to implement API key restrictions (such as HTTP referrer restrictions) in your SpotSense dashboard to prevent unauthorized usage.

const API_KEY = "YOUR_API_KEY";
const address = "221B Baker Street, London";
const url = `https://api.spotsense.ai/v1/geocode?address=${encodeURIComponent(address)}&apiKey=${API_KEY}`;

fetch(url)
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(error => console.error('Error:', error));

Node.js Example (Server-side, Query Parameter - Environment Variable)

For server-side Node.js applications, storing the API key in an environment variable is a best practice. This prevents the key from being committed to version control and allows for easy rotation across different environments.

require('dotenv').config(); // Ensure you have 'dotenv' installed for local development
const fetch = require('node-fetch'); // or axios

const API_KEY = process.env.SPOTSENSE_API_KEY; // Stored in .env file as SPOTSENSE_API_KEY=YOUR_API_KEY
const address = "Times Square, New York";
const url = `https://api.spotsense.ai/v1/geocode?address=${encodeURIComponent(address)}&apiKey=${API_KEY}`;

if (!API_KEY) {
  console.error("SPOTSENSE_API_KEY environment variable is not set.");
  process.exit(1);
}

fetch(url)
  .then(response => response.json())
  .then(data => console.log(data))
  .catch(error => console.error('Error:', error));

Security best practices

Securing your SpotSense API keys is paramount to protect your account from unauthorized usage, prevent data breaches, and ensure the integrity of your applications. Adhering to these best practices will significantly enhance the security of your integrations.

• Never embed API keys directly in client-side code without restrictions: If your application runs in a web browser or on a mobile device, an API key embedded directly in the code can be easily extracted by malicious users. Always use API key restrictions to limit its usage.
• Use environment variables for server-side applications: For backend services, store your API keys as environment variables rather than hardcoding them into your source code. This practice prevents keys from being exposed in version control systems and allows for easier key rotation and management across different deployment environments. This is a common practice for securing credentials, as detailed in various security guides for cloud platforms like Google Cloud's API key security recommendations.
• Implement API key restrictions: SpotSense allows you to restrict API keys based on HTTP referrers (for web applications) or IP addresses (for server-side applications). This ensures that even if a key is compromised, it can only be used from authorized sources.
• Rotate API keys regularly: Periodically generating new API keys and deactivating old ones reduces the window of opportunity for a compromised key to be exploited. Establish a regular rotation schedule, especially after significant changes in your development team or infrastructure.
• Monitor API usage: Regularly review your SpotSense API usage statistics within your dashboard. Unusual spikes in requests or activity from unexpected locations could indicate a compromised API key.
• Avoid exposing keys in public repositories: Ensure that your .gitignore files or equivalent configurations prevent API keys and sensitive configuration files from being committed to public or private version control systems.
• Use a proxy for client-side requests (if possible): For highly sensitive client-side applications, consider routing API requests through your own backend server. Your server can then append the API key before forwarding the request to SpotSense, acting as a secure proxy. This completely hides the API key from the client.
• Principle of Least Privilege: If SpotSense offers different types of API keys or granular permissions, generate keys with the minimum necessary permissions required for your application's functionality.

By diligently applying these security measures, you can significantly mitigate the risks associated with API key exposure and ensure the secure operation of your SpotSense-powered applications.