API keys

Create and manage keys in the developer portal. Send your key in the X-API-Key request header. Tiles and static-map image URLs also accept a ?key= query parameter so they can be used directly in <img> and map clients.

Scopes

A key can be scoped to the APIs it may call (e.g. a maps/tiles scope for a public web map, a broader scope for server use). Scope keys to the minimum your integration needs.

Server-side vs browser-safe

Treat keys as secrets. Keep privileged keys server-side and never commit them to source control. For a key that must ship to the browser (a public web map), use a narrowly-scoped, domain-restricted key and expect it to be visible — do not put a broad server key in client code.

Rotation & revocation

Rotate keys periodically and immediately revoke any key you believe is exposed. Revoked keys stop working right away; issue a replacement first to avoid downtime.

Authentication failures

A missing or invalid key returns 401 Unauthorized. A valid key without the required scope returns 403 Forbidden. See errors.

Airfree Maps keys are issued by the platform’s identity layer; the key validates at the edge before any request reaches a backend.