Authentication

Authentication is handled through API keys issued via a developer dashboard. Keys are scoped to specific user accounts and linked to institutional affiliations, such as universities, government agencies, or commercial enterprises. Each key can be assigned granular permissions, including read-only or read-write access to particular endpoints, datasets, or geographic scopes. Session tokens are not issued—every request must include the key in the Authorization header as a Bearer token, ensuring full statelessness.

Institutional tenants can manage keys through shared admin roles, revoke access instantly, and review usage logs via the dashboard. All actions are recorded in audit logs with timestamps, source IPs, and request identifiers, supporting compliance with data use agreements and internal governance policies. Keys are rotated through the dashboard, with deprecated keys remaining functional for 30 days to allow graceful handoffs. Rate limiting and access tiers are enforced at authentication time alongside the key.

No OAuth2 or JWT tokens are used; keys are simple alphanumeric strings with no cryptographic signing or encryption. This design choice keeps implementation overhead low for teams integrating with legacy systems or constrained toolchains. Authentication is always over HTTPS, and keys can be restricted by IP range or domain if required by institutional security policies. Revoked or expired keys return a 401 status with a standardized error payload.