What authentication method does Website Carbon use?

Website Carbon primarily uses API key authentication. You include a unique API key in the Authorization header of your HTTP requests to verify your identity.

How do I get my Website Carbon API key?

You can obtain your API key by registering for an account on the Website Carbon website, subscribing to an API plan (including the free tier), and then locating or generating your key in your account dashboard.

Is there a free tier for Website Carbon's API?

Yes, Website Carbon offers a free API tier that allows up to 100 requests per month. This tier also requires an API key for authentication.

Where should I place the API key in my request?

The API key should be placed in the `Authorization` HTTP header, prefixed with `Bearer`, like this: `Authorization: Bearer YOUR_API_KEY`.

What happens if I send a request without an API key?

If you send a request without a valid API key or with an incorrect one, the Website Carbon API will typically respond with an HTTP 401 Unauthorized status code, indicating an authentication failure.

Can I use Website Carbon's API key on the client side (e.g., in a browser)?

It is not recommended to embed your API key directly in client-side code, as this exposes it to public view. API keys should be kept confidential and used in server-side applications or secure environments.

How often should I rotate my API key?

While Website Carbon does not enforce a specific rotation schedule, it is a security best practice to periodically generate new API keys and revoke old ones to minimize the risk of a compromised key being exploited over time.

Website Carbon Authentication: API Key Setup & Security (2026)

Authentication overview

Website Carbon's API utilizes API keys as its primary method for authenticating requests. This approach allows the service to verify the identity of the calling application or user and enforce usage limits based on the associated subscription plan. API keys are unique identifiers that developers obtain after registering for an account and subscribing to an API plan, including the free tier for up to 100 requests per month.

When making a request to the Website Carbon API, the API key must be included in the Authorization header of the HTTP request. The API key serves as a token, granting access to the API's functionality, specifically the endpoint designed for calculating a website's carbon footprint. This method is common for web APIs where the primary goal is resource access control and usage tracking without requiring user-specific delegation of access, such as what OAuth 2.0 provides for delegated authorization.

All API communications are expected to occur over HTTPS/TLS to ensure the confidentiality and integrity of the API key and the data exchanged. This encryption prevents unauthorized interception and tampering of requests and responses, which is a fundamental security practice for web services.

Supported authentication methods

Website Carbon supports a single, consistent authentication method across its API:

API Key Authentication: This method involves generating a unique alphanumeric string (the API key) from the Website Carbon dashboard. This key is then passed with each API request to identify the caller.

The table below summarizes the key aspects of this authentication method:

Method	When to Use	Security Level	Credential Type
API Key	Direct application-to-API communication, server-side integrations, scripts, and internal tools.	Moderate (when combined with HTTPS and proper key management)	Alphanumeric string

API keys are generally suitable for application-level authentication where the application itself is the principal making the requests. They are less appropriate for scenarios requiring user-specific authorization or granular permission management, which typically benefit from more complex protocols like Google Cloud's API key best practices or OAuth 2.0.

Getting your credentials

To obtain your Website Carbon API key, follow these steps:

Register for an Account: Navigate to the Website Carbon homepage and sign up for a new account.
Subscribe to an API Plan: Access the API section of the Website Carbon website. Choose a suitable API plan. A free tier offering 100 requests per month is available, with paid plans starting from $10/month for 1,000 requests.
Access Your Dashboard: Once registered and subscribed, log in to your Website Carbon account dashboard.
Generate/Locate API Key: Within your dashboard, there will be a dedicated section for API access or developer settings where your unique API key is displayed or can be generated. The exact location may vary, but it is typically under a section named "API Keys," "Developer Settings," or similar.
Copy Your API Key: Securely copy the generated API key. This key is sensitive and should be treated like a password.

Website Carbon's documentation provides specific instructions on how to get started with their API, which includes details on obtaining and using your API key. It is recommended to consult the official documentation for the most up-to-date and precise steps.

Authenticated request example

Once you have obtained your API key, you can include it in your API requests. The Website Carbon API expects the key to be sent in the Authorization HTTP header, prefixed with Bearer. Below is an example using curl, a common command-line tool for making HTTP requests:

curl -X GET \
  'https://api.websitecarbon.com/b?url=https://www.example.com' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_API_KEY'

In this example:

-X GET specifies the HTTP GET method.
'https://api.websitecarbon.com/b?url=https://www.example.com' is the API endpoint being called, with url as a query parameter specifying the website to analyze.
-H 'Accept: application/json' informs the API that the client prefers a JSON response.
-H 'Authorization: Bearer YOUR_API_KEY' is the crucial part for authentication. Replace YOUR_API_KEY with the actual API key you obtained from your Website Carbon account dashboard. The Bearer prefix is a standard convention for token-based authentication, as defined in RFC 6750 for Bearer Token Usage.

Upon successful authentication and a valid request, the API will return a JSON object containing the carbon footprint data for the specified URL. If authentication fails (e.g., an invalid or missing API key), the API will typically return an HTTP 401 Unauthorized status code or a similar error indicating an authentication issue.

Security best practices

Securing your Website Carbon API key is critical to prevent unauthorized access to your account and API usage. Adhering to these best practices helps maintain the integrity and security of your integrations:

Keep API Keys Confidential: Treat your API key like a password. Do not embed it directly in client-side code (e.g., JavaScript running in a browser), public repositories, or commit it to version control systems without proper encryption or environment variable usage.
Use Environment Variables: For server-side applications, store your API key in environment variables rather than hardcoding it into your source code. This practice prevents the key from being exposed if your code repository is compromised.
Restrict Access to API Keys: Limit who has access to your API keys within your organization. Implement role-based access control (RBAC) if your development environment supports it.
Rotate API Keys Periodically: Regularly generate new API keys and revoke old ones. This practice minimizes the risk associated with a compromised key over time. While Website Carbon's dashboard is the primary place to manage keys, the principle applies broadly to API key management.
Implement HTTPS/TLS: Always ensure that all communications with the Website Carbon API occur over HTTPS. This encrypts the data in transit, protecting your API key from eavesdropping. Website Carbon's API endpoints automatically enforce HTTPS.
Monitor API Usage: Regularly check your API usage statistics within your Website Carbon account dashboard. Unusual spikes in usage could indicate a compromised key or unauthorized access.
Error Handling for Authentication Failures: Implement robust error handling in your application to gracefully manage authentication failures (e.g., HTTP 401 Unauthorized responses). This can help detect issues early and prevent your application from making excessive unauthorized requests.
Avoid Sharing Keys: Do not share your API key with third parties unless absolutely necessary, and ensure they follow similar security protocols.

By following these guidelines, developers can significantly reduce the risk of their Website Carbon API key being misused, thereby protecting their account and ensuring continuous, authorized access to the carbon calculation services.