APIXU Authentication: Methods, Setup, and Security (2026)

Authentication overview

Authentication for the APIXU service, now operating under Weatherstack, relies on a simple API key mechanism. This method ensures that all requests to the API are made by authorized users. An API key is a unique identifier provided to each user upon registration, serving as a token that authenticates requests. When a client application sends a request to the Weatherstack API, it includes this API key as a query parameter in the request URL. The API then validates the key against its records to grant or deny access to the requested weather data.

This approach simplifies client integration and management, as there is no complex token negotiation or refresh process involved. However, it places a strong emphasis on the secure handling and storage of the API key, as its compromise could lead to unauthorized access to your allocated API request quota. The Weatherstack API supports current weather, historical data, and forecasting functionalities, with each endpoint requiring the same API key for access.

The system is designed to provide read-only access to weather data, meaning API keys are not used for write operations or sensitive user data management, which mitigates certain security risks typically associated with broader access permissions. The underlying transport layer security (TLS) encrypts all communications, protecting the API key and data in transit as described in Cloudflare's TLS explanation.

Supported authentication methods

The Weatherstack API, which succeeded APIXU, exclusively utilizes API keys for authentication. This method is common for read-only data APIs due to its simplicity and ease of implementation. Developers embed their unique API key directly into the request URL, typically as a query parameter.

Here's a breakdown of the authentication method:

While API keys offer straightforward integration, it's crucial to understand their security implications. Unlike more complex authentication flows like OAuth 2.0, API keys alone do not provide granular permissions management or user-specific authorization beyond simply verifying access to the API. Therefore, applications must implement their own authorization logic if different users require varying levels of access to the Weatherstack API based on application-specific roles.

Getting your credentials

To obtain your APIXU (Weatherstack) API key, follow these steps:

1. Sign Up/Log In: Navigate to the Weatherstack homepage and either sign up for a new account or log in to an existing one. If you were an APIXU user, your account would have been migrated to Weatherstack.
2. Access Dashboard: Once logged in, you will be redirected to your personal API Dashboard. This dashboard is your central hub for managing your API usage, viewing analytics, and accessing your credentials.
3. Locate API Key: Your unique 32-character hexadecimal API access key will be prominently displayed on the dashboard, typically labeled as "Your API Access Key" or similar.
4. Copy Key: Copy this key for use in your application. It is recommended to store it immediately in a secure location, such as an environment variable or a secrets management system, rather than embedding it directly into your code.
5. Review Documentation: For specific usage instructions and endpoint details, refer to the Weatherstack API documentation. This documentation will guide you on how to correctly append your API key to different API requests.

Weatherstack offers a Free Plan that includes 250 requests per month, allowing developers to test the API and integrate it into their projects without initial cost. Higher request volumes are available through paid subscription tiers.

Authenticated request example

Once you have your API key, you can integrate it into your API requests. The key is passed as a query parameter, typically named access_key. All requests should be made over HTTPS to encrypt the transmission of your API key and data.

Here is an example of an authenticated request using cURL to retrieve current weather data for New York:

curl "http://api.weatherstack.com/current?access_key=YOUR_ACCESS_KEY&query=New%20York"

Important: Replace YOUR_ACCESS_KEY with your actual API key obtained from your Weatherstack dashboard. While the example uses http://, it is critical to use https:// in production to protect your API key in transit.

// Node.js example using 'node-fetch'

const fetch = require('node-fetch');

const ACCESS_KEY = process.env.WEATHERSTACK_API_KEY; // Stored securely
const CITY = 'London';

async function getCurrentWeather(city) {
  try {
    const response = await fetch(`https://api.weatherstack.com/current?access_key=${ACCESS_KEY}&query=${city}`);
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    const data = await response.json();
    console.log(`Current weather in ${city}:`, data.current.temperature + '°C');
  } catch (error) {
    console.error('Error fetching weather data:', error);
  }
}

getCurrentWeather(CITY);

In the Node.js example, process.env.WEATHERSTACK_API_KEY demonstrates the practice of loading the API key from an environment variable, which is a recommended security measure. Never hardcode sensitive credentials directly into your application's source code.

Security best practices

Securing your APIXU (Weatherstack) API key is crucial to prevent unauthorized access and potential abuse of your allocated request quota. Adhering to these best practices will help maintain the integrity and security of your API integration:

1. Use HTTPS for All Requests: Always ensure your API requests are made over HTTPS. This encrypts the communication channel between your application and the Weatherstack API, protecting your API key and the data exchanged from eavesdropping. Weatherstack automatically redirects HTTP requests to HTTPS, but explicit use of HTTPS URLs is recommended to avoid unnecessary redirects and potential exposure.
2. Never Hardcode API Keys: Avoid embedding your API key directly into your source code. Hardcoded keys can be exposed if your code repository is compromised or when distributed in client-side applications. Instead, store API keys in environment variables, configuration files that are excluded from version control (e.g., using .env files with .gitignore), or dedicated secrets management services.
3. Server-Side Access Only: Whenever possible, access the Weatherstack API from server-side applications rather than directly from client-side code (e.g., JavaScript in a web browser). This prevents your API key from being exposed to end-users, who could potentially extract it from network requests in their browser's developer tools. If client-side access is unavoidable, consider implementing a proxy server to mediate requests, adding an extra layer of abstraction and control.
4. Restrict Referrers/IP Addresses (if available): Some API key management systems offer the ability to restrict API key usage to specific HTTP referrers or IP addresses. While Weatherstack's dashboard does not currently offer referrer or IP restrictions, it is a general best practice for API keys where supported, as outlined in Google Maps API security best practices. Regularly check the Weatherstack dashboard for updates to key management features.
5. Regularly Rotate API Keys: Periodically generate new API keys and revoke old ones. This practice, known as key rotation, limits the window of opportunity for a compromised key to be exploited. Weatherstack's dashboard allows you to regenerate your API key, invalidating the previous one.
6. Monitor API Usage: Regularly review your API usage statistics available in your Weatherstack dashboard. Unexpected spikes in usage could indicate unauthorized access to your API key. Set up alerts if the dashboard offers such functionality to be notified of unusual activity.
7. Implement Error Handling: Implement robust error handling in your application to gracefully manage API authentication failures. This can prevent sensitive information from being logged or displayed to end-users in case of an invalid or expired API key.

By diligently following these security measures, developers can significantly reduce the risk of API key compromise and ensure the secure operation of applications integrating with the Weatherstack (APIXU) service.