Transport for Norway Authentication: API Access & Security (2026)

Authentication overview

Transport for Norway (Entur) employs a straightforward authentication mechanism primarily centered around API keys. This method is designed to provide secure and manageable access to its public transport data APIs, including the Journey Planner, Real-time Data, and Stop Place APIs. The API key serves as a unique identifier and a secret token that authenticates requests made by client applications, ensuring that only authorized entities can consume the data. This approach simplifies integration while enabling Entur to monitor usage and apply rate limits as necessary, contributing to the stability and fairness of service for all developers Transport for Norway API documentation.

When an application makes a request to any of Entur's protected endpoints, it must include a valid API key. This key is typically passed within an HTTP header, a common practice for securing API communications. The system verifies the key against its records; if the key is valid and active, the request is processed. If the key is missing, invalid, or revoked, the request is rejected, usually with an HTTP 401 Unauthorized or 403 Forbidden status code. This access control mechanism is fundamental for protecting the integrity and availability of the public transport data infrastructure.

Supported authentication methods

Transport for Norway primarily supports API key authentication for accessing its public data APIs. This method is suitable for server-to-server communication and client-side applications where the API key can be securely stored or managed. While other authentication protocols like OAuth 2.0 offer more granular control over delegated access, API keys provide a simpler and often sufficient solution for public data consumption scenarios where user-specific authorization is not required OAuth 2.0 Bearer Token Usage.

The API key acts as a secret that grants access to the associated account's permissions. It is crucial to treat these keys with the same level of security as passwords. The table below outlines the primary authentication method and its characteristics:

For scenarios requiring more complex authorization flows, such as granting third-party applications limited access to a user's private data without sharing their credentials, protocols like OAuth 2.0 would typically be employed. However, for Transport for Norway's public datasets, API keys are the established and effective method OAuth.net official website.

Getting your credentials

To obtain your API key for Transport for Norway's APIs, you must register an account on their developer portal. The process typically involves a few steps:

1. Visit the Developer Portal: Navigate to the Transport for Norway developer portal.
2. Register an Account: If you don't already have one, sign up for a new developer account. This usually requires providing an email address, setting a password, and agreeing to the terms of service.
3. Log In: Once registered and verified (if email verification is required), log in to your new developer account.
4. Access API Key Management: Within your developer dashboard or profile settings, there will typically be a section dedicated to API key management. Here, you can generate new keys, view existing ones, and manage their status (e.g., revoke a compromised key).
5. Generate Your API Key: Follow the instructions to generate a new API key. The portal will display your unique key. It is critical to copy this key immediately and store it securely, as it may only be shown once for security reasons.
6. Review Usage Policies: Before making requests, familiarize yourself with the Transport for Norway API usage policies and rate limits associated with your API key.

Once you have your API key, you are ready to include it in your API requests. Remember that each API key is associated with your developer account and its usage is subject to the terms and conditions outlined by Transport for Norway.

Authenticated request example

To make an authenticated request to a Transport for Norway API endpoint, you must include your API key in the x-api-key HTTP header. The following example demonstrates a typical GET request using curl to query a hypothetical endpoint, replacing YOUR_API_KEY with your actual key and YOUR_ENDPOINT_URL with the specific API endpoint you wish to access.

curl -X GET \
  'YOUR_ENDPOINT_URL' \
  -H 'x-api-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json'

For instance, if you were querying a real-time departures endpoint, your request might look like this:

curl -X GET \
  'https://api.entur.org/realtime/v1/departures?stopId=1234' \
  -H 'x-api-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json'

In this example:

• -X GET specifies the HTTP method.
• 'https://api.entur.org/realtime/v1/departures?stopId=1234' is the target API endpoint, including any query parameters.
• -H 'x-api-key: YOUR_API_KEY' is the crucial header that carries your authentication credential.
• -H 'Content-Type: application/json' and -H 'Accept: application/json' indicate the expected data formats for the request body and response, respectively.

When implementing this in a programming language, the principle remains the same: add the x-api-key header with your key to the HTTP request before sending it. Many HTTP client libraries provide straightforward ways to add custom headers to requests.

Security best practices

Securing your API keys is paramount to prevent unauthorized access, misuse of your quota, and potential security breaches. Adhering to these best practices will help maintain the integrity of your applications and data when interacting with Transport for Norway's APIs:

1. Keep API Keys Confidential: Treat your API keys as sensitive as passwords. Do not embed them directly in client-side code (e.g., JavaScript in web pages, mobile app binaries) where they can be easily extracted.
2. Use Environment Variables or Secret Management Services: For server-side applications, store API keys in environment variables or a dedicated secret management service (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). This prevents keys from being committed to source control and exposed AWS Secrets Manager overview.
3. Avoid Hardcoding Keys: Never hardcode API keys directly into your application's source code. This makes key rotation difficult and increases the risk of exposure if the code repository is compromised.
4. Implement Server-Side Proxying for Client Applications: If your application runs client-side (e.g., a single-page application or a mobile app) and needs to access Transport for Norway's APIs, route requests through your own secure backend server. Your backend server can then securely add the API key before forwarding the request to Entur's API, thus shielding the key from the client.
5. Restrict API Key Permissions (if applicable): While Transport for Norway's API keys primarily grant access to public data, if there were ever a future expansion to more granular permissions, always follow the principle of least privilege. Grant only the necessary permissions required by the application.
6. Monitor API Usage: Regularly monitor your API key's usage through the developer portal. Unusual spikes or patterns might indicate unauthorized use.
7. Rotate API Keys Periodically: Periodically generate new API keys and revoke old ones. This practice limits the window of opportunity for a compromised key to be exploited.
8. Secure Your Developer Account: Use strong, unique passwords for your Transport for Norway developer account. Enable multi-factor authentication (MFA) if offered, as it adds an extra layer of security against unauthorized access to your keys Google's guide to 2-Step Verification.
9. Implement Rate Limiting and Error Handling: While Entur applies its own rate limits, implementing client-side rate limiting and robust error handling (especially for 401 Unauthorized and 403 Forbidden responses) can help detect and respond to potential API key issues or abuse attempts.

By diligently applying these security measures, you can significantly reduce the risk of your Transport for Norway API keys being compromised and ensure the continued secure operation of your integrated applications.