The endpoints this site uses stay public, with no key, for the site and anyone who reads them politely. An API key is for software you run yourself: a script, a dashboard, your own app. Every request it makes is counted against your account and limited per key rather than per address, so a NAT or a shared office does not cost you anything.
Keyed access is under the API Terms in Terms §20 and §21, as well as everything the public endpoints are under.
Make a key
Sign in, open Account, and use Create a key. Pick what it can read and when it expires. Keys expire after 30 days unless you choose a longer term or Never. The key is shown once. Copy it then; it is stored only as a hash and nobody can show it to you again. A lost key is revoked and replaced.
Keys look like wx_live_ followed by 43 characters. You can hold up to ten
live keys. Use one per program, so revoking one stops only that program.
Send it
Use the same paths as the public API, with /v1 in front, and send the key in
a header. Both of these work. Use whichever your client can set.
curl -H "X-API-Key: wx_live_..." https://api.wxalerts.org/v1/alerts/active
curl -H "Authorization: Bearer wx_live_..." https://api.wxalerts.org/v1/alerts/activeNever put a key in a URL. A request with ?key= or ?api_key= on /v1 is
refused with 400 key_in_query, because URLs end up in logs, browser history
and Referer headers. If you sent one that way, revoke it and make a new one.
Never put a key in a web page. Anyone who opens the page can read it. Browsers block calls to the API from other websites anyway (CORS allows only wxalerts.org), so a web page of your own should fetch through a server you run, which holds the key.
Revoke a key
Revoke a key from the Account page. It stops working within a minute everywhere. A key also stops working if it expires or if the account is disabled or deleted.
The Account page shows when each key was last used and how many requests it made in the last 30 days. The counts trail by up to a minute.
Which routes need a key, what each scope allows and what the error codes mean are in Authentication.