API Authentication Methods Explained

At a Glance

API Key Authentication

API keys are the most common authentication method. You register on the provider's website, get a key, and include it in your request headers or query parameters.

const url = "https://www.adoptapet.com/public/apis/";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

OAuth Authentication

OAuth is used when an API needs to access user data on behalf of the user. It involves a multi-step flow: redirect to provider, user grants permission, receive access token.

# ⚠️ Note: This URL may be a documentation page. Check official docs for actual API endpoint.
import requests

url = "https://aniapi.com/docs/"
headers = {"Authorization": "Bearer YOUR_API_KEY"}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()
data = response.json()
print(data)

Worked Example

Visual Walkthrough: Getting Your First API Key

Here is what the process actually looks like, using OpenWeatherMap (which has a free plan) as a real example. The annotated screenshots below walk you from the signup form to an authenticated API request.

Step 1: Create a free account

• 1 Choose a username — this is just your display name on the platform.
• 2 Enter your email address — you will need to verify it, so use a real inbox.
• 3 Set a password for your new account.
• 4 Tick the reCAPTCHA checkbox, then click Create Account. OpenWeatherMap will send you a confirmation email — click the link inside it to verify your email. Your API key is activated automatically, but activation can take up to two hours.

Step 2: Use the key in your request

• 1 Once your key is issued, you pass it as the appid query parameter in the request URL — replace {API key} with your own key to authenticate the request. One practical rule from day one: never commit your key to a public repository — keep it in an environment variable instead.

Frequently Asked Questions