API Key Management
Create, scope, restrict, rotate, and revoke Planisfy API keys.
API Key Management
API keys authenticate service API requests and can also attach owner context to private map asset reads.
Create a key
In Console, open API keys and create a key with:
- A name that identifies the app or environment.
- Only the scopes the integration needs.
- Optional browser-origin restrictions for browser-facing keys.
- An expiry date when the key is temporary or used by automation.
Use the key with:
curl "https://api.example.com/geocoding/v1/forward?q=Lagos" \
-H "X-API-Key: pk_your_key_here"Scopes
Use narrow scopes for public clients. A map display client usually needs public asset reads and selected service scopes. Server-side automation can use broader scopes, but should still be separated by environment and purpose.
Common service areas include geocoding, directions/routing, elevation, static maps, and tiles/styles access.
Browser-origin restrictions
Browser-origin restrictions provide best-effort abuse friction for keys embedded in browser apps. If a request origin does not match the key policy, the API can return 403 DOMAIN_NOT_ALLOWED.
Origin and Referer are client-supplied headers. Non-browser clients can forge them, so this feature does not prove where a request originated and is not an authorization boundary. Keep privileged keys on the server, use narrow scopes and quotas, and use browser-origin restrictions only as defense in depth.
Rotation
Rotate keys by creating a replacement, deploying the new value, watching traffic shift, and deleting the old key after clients have moved.
Expired keys return 401 KEY_EXPIRED. Deleted or invalid keys return 401 UNAUTHORIZED.