Aemet Authentication: API Key Setup and Best Practices (2026)

Authentication overview

The Aemet Open Data API provides access to official Spanish meteorological data, including forecasts, climatological records, and observational data. To ensure controlled access and manage resource usage, authentication is required for all API requests. Aemet utilizes a straightforward API key authentication mechanism, which allows developers to integrate weather data into their applications after a simple registration process. This method helps Aemet monitor API consumption and enforce rate limits, which are set at a maximum of 300 requests per minute and 10 requests per second for the free tier (Aemet API documentation). Adhering to these limits is crucial for maintaining uninterrupted service.

The API key functions as a unique identifier for your application, linking your requests to your registered account. It is essential to treat this key as a sensitive credential, similar to a password, to prevent unauthorized usage and potential service disruptions.

Supported authentication methods

Aemet's Open Data API primarily supports API key authentication. This method is common for public APIs where the primary concern is identifying the user for rate limiting and basic access control rather than complex identity management. The API key is passed as an HTTP header in each request.

While API keys offer a practical solution for many web services, developers should be aware of their security implications. They do not provide the same granularity of permissions or user context as methods like OAuth 2.0 OAuth 2.0 specification, which are designed for delegated authorization scenarios. For Aemet, the API key serves as the primary access token.

Getting your credentials

To obtain an API key for the Aemet Open Data API, you must complete a registration process on the official Aemet website. This process is free and grants access to the API's services. Follow these steps:

1. Navigate to the Aemet Open Data Portal: Visit the official Aemet Open Data API page.

2. Locate the Registration Section: Look for a section related to API access or registration. This is typically labeled with terms like "Solicitar clave API" (Request API key) or similar.

3. Complete the Registration Form: You will likely need to provide basic information, such as your name, email address, and possibly the intended use of the API. Ensure all required fields are filled accurately.

4. Agree to Terms and Conditions: Review and accept Aemet's terms of service and any data usage policies. This may include adherence to GDPR compliance, which Aemet observes Aemet compliance documentation.

5. Receive Your API Key: Upon successful registration, your API key will typically be displayed on screen or sent to your registered email address. It is crucial to copy and store this key securely immediately.

6. Activate (if necessary): In some cases, you might need to click a link in a confirmation email to activate your account or API key.

It's important to note that the API key is a long string of alphanumeric characters. Do not share it publicly or embed it directly into client-side code that could be easily inspected by users.

Authenticated request example

Once you have obtained your API key, you can include it in your HTTP requests to the Aemet API. The API key must be sent in the api_key header. Below are examples using curl and Python's requests library.

Curl example

curl -X GET \
  'https://opendata.aemet.es/opendata/api/observacion/ultima/area/...' \
  -H 'accept: application/json' \
  -H 'api_key: YOUR_AEMET_API_KEY'

Replace YOUR_AEMET_API_KEY with your actual API key and adjust the endpoint URL (/observacion/ultima/area/...) to the specific Aemet data you wish to retrieve. The accept: application/json header indicates that you prefer a JSON response.

Python example

import requests

api_key = "YOUR_AEMET_API_KEY"
url = "https://opendata.aemet.es/opendata/api/prediccion/especifica/municipio/28079"

headers = {
    "accept": "application/json",
    "api_key": api_key
}

try:
    response = requests.get(url, headers=headers)
    response.raise_for_status()  # Raise an exception for HTTP errors
    data = response.json()
    print(data)
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

This Python example fetches specific forecast data for a municipality. Ensure you substitute YOUR_AEMET_API_KEY with your key and the url with the desired endpoint from the Aemet API reference documentation.

Security best practices

Securing your API key is paramount to prevent unauthorized access to your Aemet API quota and data. Follow these best practices:

• Never Expose API Keys in Client-Side Code: Do not embed your API key directly in frontend JavaScript, mobile app binaries, or other code that runs on a user's device. These keys can be easily extracted.

• Use Environment Variables or Configuration Files: For server-side applications, store your API key in environment variables (e.g., AEMET_API_KEY) or secure configuration management systems. This keeps the key out of your codebase and allows for easy rotation without code changes.

  import os
  api_key = os.getenv("AEMET_API_KEY")

• Implement a Proxy Server: If your application is primarily client-side, route all API requests through a secure backend proxy server. Your client-side code calls your proxy, which then adds the API key and forwards the request to Aemet. This protects the key from exposure.

• Restrict API Key Usage (if applicable): While Aemet's API keys are generally global for the account, for other APIs that offer it, restrict the key to specific IP addresses or HTTP referrers if your infrastructure supports it. This minimizes the risk if a key is compromised.

• Rotate API Keys Periodically: Regularly generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. Check the Aemet developer portal for options to manage and rotate your keys.

• Monitor Usage: Keep an eye on your API usage statistics on the Aemet developer dashboard. Unusual spikes in requests could indicate a compromised key or an issue with your application. Unauthorized activity could be a sign of a data breach Google Cloud security best practices.

• Secure Your Development Environment: Ensure that your local development machine and source control systems (e.g., Git repositories) are secure and do not inadvertently expose API keys.