Skip to main content
Every request must include your API key in the X-API-Key header.
Requests without a valid key return 401.

​
Scopes

Keys are scoped to specific topics or to bundles. A key with only the wildfire scope can call /v1/wildfire/risk but not /v1/brownfield/risk. If your key lacks the required scope, you get 403 — not 401. The distinction matters:
  • 401 — we don’t know who you are. Missing, malformed, revoked, or expired key.
  • 403 — we know who you are, but you’re not allowed to do this.

​
Keeping your key safe

Treat your API key like a password.
  • Never commit it to source control. Use environment variables or a secrets manager.
  • Never expose it in client-side code. Anyone can read it from a browser. Call the API from your backend.
  • Rotate it if it leaks. Contact us immediately and we revoke compromised keys on the spot.

​
Rotation

We support planned rotation with a grace period. During rotation, both your old and new key work simultaneously, giving you time to deploy the new one without downtime. The old key stops working when the grace period ends. For emergency revocation (a leaked key), the old key is killed immediately. To rotate, contact your account manager.