Guides
Authentication
Understand API key, session, public asset, and private-owner access rules.
Authentication
Planisfy supports two normal authentication paths:
X-API-Keyfor API integrations.- Authenticated Console sessions for browser Console requests.
Public published map assets under /tiles/*, /styles/v1/*, and /fonts/* can load without a key when the resource is public.
API keys
Send API keys with:
curl "https://api.example.com/directions/v1/driving/9.18,48.77;9.2,48.78" \
-H "X-API-Key: pk_your_key_here"Do not use Mapbox-style access_token as the primary auth mechanism. See API key management for scopes, domain restrictions, expiry, and rotation.
Public assets
Published public styles, tiles, and glyphs can be used directly in MapLibre clients. A valid API key or session may still attach identity for private-owner reads and metering.
Service APIs
These API groups require API key or session auth:
- Geocoding
- Directions, isochrones, matching, matrix, and optimized trips
- Elevation
- Static maps
Review API conventions before integrating service APIs.
Common auth errors
| Code | Meaning |
|---|---|
UNAUTHORIZED | The key or session is missing or invalid. |
KEY_EXPIRED | The API key expiry date has passed. |
DOMAIN_NOT_ALLOWED | The key is restricted to different request origins. |
SCOPE_DENIED | The key does not include the required scope. |
FORBIDDEN | The authenticated owner cannot read the requested private resource. |