INEI Authentication: API Access & Security Best Practices (2026)

Authentication overview

The Instituto Nacional de Estadística e Informática (INEI) provides programmatic access to its extensive collection of Peruvian statistical data through a REST API. This API facilitates access to various datasets, including census data, economic indicators, social statistics, and demographic projections, which are valuable for academic research, public policy analysis, and market research in Peru. Authentication for the INEI API is primarily managed through the use of API keys, ensuring that access to data resources is controlled and monitored.

An API key serves as a unique identifier and a secret token that authenticates the user or application making a request. When a client makes a request to the INEI API, this key must be included, allowing the INEI servers to verify the request's origin and grant access to the requested data. The INEI's approach to authentication is designed for simplicity and efficiency, enabling developers to integrate INEI data into their applications with minimal overhead, while still maintaining a necessary level of security for the public datasets it provides.

It is important to understand that while API keys offer a straightforward authentication mechanism, they are not typically designed to identify individual users within an application, but rather to identify the application or developer account itself. For more advanced user-level authentication or authorization, developers often implement additional layers within their own applications, leveraging the API key for initial access to the INEI data. Detailed information on the INEI's API services is available on their official INEI API de Datos page.

Supported authentication methods

The INEI API primarily supports API key authentication. This method is common for public data APIs where the primary concern is identifying the calling application rather than individual end-users. API keys are generated through the INEI's developer portal and are then included with each API request to authorize access.

API Key Authentication

API keys are unique alphanumeric strings provided to developers upon successful registration. When making requests to the INEI API, this key must be included in either the request header or as a query parameter. The specific parameter name or header field is detailed in the INEI API documentation.

This method offers a balance between ease of implementation and basic security. It allows the INEI to track API usage, enforce rate limits, and identify the source of requests. However, developers are responsible for the secure handling of their API keys to prevent unauthorized access.

The following table summarizes the primary authentication method supported by the INEI API:

Getting your credentials

To access the INEI API, you will need to obtain an API key. The process typically involves registering on the INEI's developer portal or a designated section of their website. As the INEI's services are geared towards public data, the registration process is usually straightforward, aimed at facilitating access for researchers, developers, and institutions.

1. Visit the INEI API Portal: Navigate to the official INEI API de Datos page. While the primary documentation is in Spanish, the process generally involves finding a section for API access or developer registration.
2. Registration: Look for options like "Registro" (Register) or "Obtener Clave API" (Get API Key). You may need to provide basic information such as your name, email address, organization (if applicable), and the intended use of the API. This helps INEI understand the user base and potential data applications.
3. Key Generation: After successful registration and possibly email verification, your API key will be generated and made available through a developer dashboard or directly sent to your registered email address.
4. Key Management: Once you have your API key, it is crucial to store it securely. Treat your API key like a password. Do not hardcode it directly into client-side code that could be publicly exposed, and avoid committing it to public version control repositories.

The INEI provides this access to promote the use of their statistical data, aligning with its mission as the official body for statistics in Peru. Always refer to the most current instructions on the INEI API documentation for precise steps, as processes can be updated.

Authenticated request example

Once you have obtained your API key from the INEI developer portal, you can use it to authenticate your requests to the INEI API. The exact method of including the API key (header vs. query parameter) will be specified in the INEI API documentation. For demonstration purposes, let's assume the API key is passed as a query parameter named apikey.

Consider an example where you want to retrieve a specific dataset from the INEI API. The base URL and endpoint path would be provided in the API documentation. A typical authenticated request using curl might look like this:

curl -X GET \
  "https://api.inei.gob.pe/v1/data/some-dataset-id?year=2023&apikey=YOUR_INEI_API_KEY"

In this example:

• -X GET specifies the HTTP GET method, commonly used for retrieving data.
• https://api.inei.gob.pe/v1/data/some-dataset-id is a hypothetical endpoint URL for accessing a specific dataset. You would replace some-dataset-id with the actual identifier for the data you wish to retrieve.
• ?year=2023 is an example of an additional query parameter to filter the data, which might be specific to the dataset you're querying.
• apikey=YOUR_INEI_API_KEY is where you substitute YOUR_INEI_API_KEY with the actual API key you received from INEI. This parameter authenticates your request.

If the INEI API requires the API key to be sent in an HTTP header, the request would be structured differently, for example:

curl -X GET \
  -H "X-Api-Key: YOUR_INEI_API_KEY" \
  "https://api.inei.gob.pe/v1/data/another-dataset-id?filter=value"

Here, -H "X-Api-Key: YOUR_INEI_API_KEY" adds an HTTP header named X-Api-Key with your API key as its value. Always consult the official INEI API documentation for the precise method of API key inclusion and available endpoints.

Security best practices

Proper handling of API keys is crucial to prevent unauthorized access to the INEI API and to ensure the integrity of your applications. While INEI data is public, misuse of API keys can lead to rate limiting, account suspension, or other service disruptions. Adhering to these security best practices will help maintain secure and reliable access:

1. Keep API Keys Confidential: Treat your API key as a sensitive credential, similar to a password. Never embed API keys directly into publicly accessible client-side code (e.g., JavaScript in a web browser) or commit them to public version control systems like GitHub.
2. Use Environment Variables: For server-side applications, store API keys in environment variables rather than hardcoding them into your source code. This practice separates credentials from code, making it easier to manage and secure them across different deployment environments. For example, in Node.js, you might access process.env.INEI_API_KEY.
3. Avoid Client-Side Exposure: If your application is client-side (e.g., a single-page application), consider using a backend proxy server to make API requests. Your client-side application would call your proxy, which then adds the API key and forwards the request to the INEI API. This prevents the API key from ever being exposed in the client's browser or network traffic.
4. Implement HTTPS: Always ensure that all communications with the INEI API are conducted over HTTPS. This encrypts the data exchanged, including your API key, protecting it from interception during transit. Most modern API clients and libraries default to HTTPS, but it's important to verify. The IETF's RFC 7230 details general HTTP/1.1 message syntax and routing, emphasizing secure transmission protocols.
5. Restrict API Key Usage (if applicable): If the INEI API offers features to restrict API keys by IP address or HTTP referrer, utilize these options. This adds an extra layer of security, ensuring that even if a key is compromised, it can only be used from authorized locations or domains.
6. Monitor API Usage: Regularly monitor your API usage through any provided INEI developer dashboard. Unexpected spikes in usage could indicate a compromised key or unauthorized activity.
7. Rotate API Keys: Periodically rotate your API keys. If your key is compromised, changing it regularly limits the window of exposure. While the INEI's documentation doesn't explicitly detail key rotation, it's a general security practice to consider if supported.
8. Error Handling: Implement robust error handling in your application to gracefully manage API authentication failures. This can help identify issues quickly and prevent unintended data access.

By following these best practices, developers can significantly enhance the security of their applications when interacting with the INEI API, safeguarding their access and contributing to the overall security posture of data consumers.