Authentication
Use server-side bearer tokens, keep environments isolated, and manage API keys from your console.
Send a bearer token
All public Maps API operations require an API key through the Authorization: Bearer YOUR_API_KEY header. Each generated request example includes this header.
Create and revoke keys
Use API keys in your console. Store newly created keys securely; avoid logging them or including them in URLs. Revoke a key when it is no longer needed or may have been exposed.
Call from your server
Secret API keys must stay on your server. The documentation's JavaScript snippets are server-side examples, not browser integration instructions.
Keep UAT and production separate
UAT uses sk_test_ keys and isolated accounts and credits. Production uses sk_live_ keys. A valid key for one environment is not a credential for another.
Authentication failures
A missing or invalid key returns 401. Account access restrictions can return 403. Check the error response and correlate its request identifier with your logs.