Authentication

API Authentication

The Mapsemble API uses API keys (Bearer tokens) for authentication. All API requests must be authenticated unless otherwise noted.

There are two authentication methods:

1. API Key (Bearer Token): for server-to-server API calls
2. OAuth2 Client Credentials: for application-level access

Getting your API key

1. Log in to your Mapsemble account
2. Go to Account Settings
3. Navigate to the API Keys section
4. Click Generate New Key
5. Copy the key immediately — it won't be shown again

Using your API key

Include the key in the Authorization header:

curl -H "Authorization: Bearer YOUR_API_KEY" \
     https://app.mapsemble.com/api/v1/maps

OAuth2 Client Credentials

For application integrations, Mapsemble supports OAuth2 client_credentials flow:

1. Register an OAuth2 application in your account settings
2. Use the client ID and secret to request an access token
3. Use the access token as a Bearer token in API requests

Authentication errors

• 401 Unauthorized: missing or invalid API key
• 403 Forbidden: valid key but insufficient permissions (e.g., accessing another user's map)

Security best practices

• Never expose your API key in client-side code. Always make API calls from your server.
• Rotate keys regularly. Revoke compromised keys immediately.
• Use environment variables to store keys, not hardcoded values.
• Each API key is scoped to your account — it can access all your maps.