Authentication

Bearer tokens

Pass the key in the Authorization header. There is no query-string alternative, which keeps secrets out of access logs and browser history.

Authorization: Bearer geo_live_xxxxxxxxxxxxxxxxx

Keys are scoped to one product

A geo_live_ key authenticates the geolocation product and nothing else. Presenting it to the currency or global data APIs answers 403 with product_access_denied. Each product also carries its own subscription, quota and key allowance.

Live and test prefixes

• geo_live_ for production traffic.
• geo_test_ for staging and local development.
• Both consume the same plan quota, so treat test volume as real volume.

Storage and rotation

Only a prefix and a secure hash are stored, so the platform cannot show you a key again after creation. Rotating a key issues a new secret and invalidates the previous one immediately, with no overlap window.

What is validated

• The key exists and is active, not disabled or revoked.
• The key belongs to the product being called.
• The account holds an active subscription for that product.
• The per-minute rate limit has room.
• The monthly quota has room.