Authentication

Every request to the Cirrosense API must be authenticated. Authentication is done by passing your API key as the key query parameter:

Managing Your Keys

API keys can be created and deleted from the Keys page in the developer portal. You can create multiple keys — for example, one per application or environment — and delete any key that is no longer needed.

Keep Your Key Secret

Your API key grants access to your account and counts against your usage quota. Treat it like a password:

• Do not share it with others or commit it to version control.
• Do not include it in public repositories or issue trackers.
• If a key is compromised, delete it in the developer portal immediately and create a new one.

Server-Side Requests Only

API requests must be made from your server, not from client-side (browser) code. Making requests from the front-end would expose your API key to anyone who inspects the page source or network traffic — even if you try to obfuscate it.

Instead, create a thin backend endpoint in your application that calls the Cirrosense API and forwards the data to your front-end. Your key stays on the server and is never sent to the browser.