Start here
Start here
API keys and safe authentication
Choose a publishable or secret key, restrict it, and send it from the correct environment.
What you’ll achieve
You will know which key belongs in a browser and which must stay on your server.
Publishable vs secret keys
Publishable keys are designed for web and mobile clients and should be origin- or app-restricted. Secret keys can access server products and must never be exposed in a client bundle.
Send a key
Server requests should use the X-MapScale-Key header. Map style URLs can receive a publishable key in the URL because MapLibre fetches their dependent assets.
X-MapScale-Key: $MAPSCALE_API_KEYDebug 401 and 403 responses
401 means no valid key reached the API. 403 means the key is valid but the product, origin or environment is not allowed. Check proxy headers and exact origin—including scheme and port.