Open Charge Map Authentication: API Key Access (2026)

Authentication overview

Open Charge Map provides access to its global electric vehicle (EV) charging station database through a RESTful API. Authentication for this API primarily relies on the use of API keys. These keys serve to identify the requesting application and track its usage against any applicable rate limits or service tiers. The API key model is a common authentication pattern for public-facing APIs, allowing developers to quickly integrate data while providing the service provider with a mechanism for monitoring and controlling access (Google Maps API key explanation).

When making requests to the Open Charge Map API, developers include their unique API key within the request. This key acts as a credential, granting the application permission to retrieve charging station data, submit new data (if authorized), or perform other operations supported by the API. Proper management and security of API keys are essential to prevent unauthorized access and potential misuse of an application's allocated API quota.

The Open Charge Map platform supports both read-only access for general data consumption and write access for contributing new data or updates, with authentication facilitating these different levels of interaction. The developer portal offers tools for managing API keys, monitoring usage, and accessing documentation to ensure smooth integration of the EV charging data into various applications (Open Charge Map developer documentation).

Supported authentication methods

Open Charge Map primarily utilizes API keys for authenticating requests to its API. This method is straightforward and widely adopted for public data APIs where the primary goal is resource access and usage tracking. While OAuth 2.0 is a more complex protocol used for delegated authorization between services (OAuth 2.0 specification overview), Open Charge Map's current authentication model focuses on the direct identification of the client application via a unique key.

API Key Authentication

API key authentication involves passing a unique string, the API key, with each request to the Open Charge Map API. This key is generated through the developer portal and linked to a specific user account or application. The presence and validity of this key inform the API that the request originates from an authorized source, allowing the API to process the request and apply any associated usage policies.

The API key is typically transmitted as a query parameter in the request URL. This method is suitable for applications that primarily retrieve public data, where the risk of the key being exposed in transit is mitigated by the mandatory use of HTTPS. For operations that modify data or require higher levels of trust, additional security considerations apply, such as ensuring the API key is not hardcoded or exposed in client-side code.

The following table summarizes the primary authentication method:

Getting your credentials

To obtain an API key for Open Charge Map, you need to register for a developer account on their platform. The process typically involves a few steps:

1. Account Registration: Navigate to the Open Charge Map website and sign up for a new user account. This usually requires providing an email address and creating a password.
2. Developer Portal Access: Once registered, log in to your account and locate the developer or API section. This area is specifically designed for managing API access and credentials (Open Charge Map developer help).
3. API Key Generation: Within the developer portal, there will be an option to generate a new API key. The platform provides instructions on how to create, revoke, and manage your keys. It's common for platforms to allow the creation of multiple keys for different applications or environments (e.g., development, staging, production) to enhance security and organization.
4. Key Management: The generated API key will be displayed to you. It's critical to copy this key immediately and store it securely. Unlike passwords, API keys are often not recoverable if lost, and a new one may need to be generated. The developer portal will also typically provide functionality to view existing keys, monitor their usage, and revoke them if compromised or no longer needed.

Ensure that you understand the terms of service and any usage limits associated with your API key, especially for commercial applications, as free tier access may have specific restrictions (Open Charge Map API limits).

Authenticated request example

Once you have obtained your API key, you can include it in your requests to the Open Charge Map API. The key is typically passed as a query parameter named key or apiKey. For Open Charge Map, the parameter is key.

Here's an example using curl to fetch a list of charging locations:

curl -X GET \
  'https://api.openchargemap.io/v3/poi/?output=json&countrycode=GB&maxresults=10&compact=true&verbose=false&key=YOUR_API_KEY'

In this example:

• YOUR_API_KEY should be replaced with the actual API key you obtained from the Open Charge Map developer portal.
• The request retrieves up to 10 charging locations (maxresults=10) in Great Britain (countrycode=GB) in a compact JSON format.

Example in Python:

import requests

api_key = "YOUR_API_KEY"
base_url = "https://api.openchargemap.io/v3/poi/"

params = {
    "output": "json",
    "countrycode": "US",
    "maxresults": 5,
    "compact": True,
    "verbose": False,
    "key": api_key
}

response = requests.get(base_url, params=params)

if response.status_code == 200:
    data = response.json()
    print(data)
else:
    print(f"Error: {response.status_code} - {response.text}")

This Python example demonstrates how to construct a request using the requests library, passing the API key as part of the query parameters dictionary. This ensures the key is properly URL-encoded and included in the API call.

Security best practices

Securing your Open Charge Map API key is crucial to prevent unauthorized access to your account's quota and to maintain the integrity of your applications. Adhering to fundamental security practices for API keys is essential:

1. Keep API Keys Confidential

• Do not embed keys directly in client-side code: Never hardcode API keys directly into public-facing client-side JavaScript, mobile applications that can be decompiled, or any code that will be distributed to end-users. Such exposure allows anyone to extract and misuse your key.
• Use environment variables or configuration files: For server-side applications, store your API key in environment variables, secure configuration files, or a secrets management service (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). Fetch the key at runtime, keeping it out of your version control system.
• Restrict access to your source code: Ensure that your repository with API keys (even if in config files) is private and properly secured.

2. Use HTTPS for All API Calls

• Always make API requests over HTTPS to encrypt the communication channel. This protects your API key and other sensitive data from interception during transit. Open Charge Map's API endpoints automatically enforce HTTPS (Open Charge Map API security practices).

3. Restrict API Key Usage (if applicable)

• While Open Charge Map's key management might not offer granular IP or referrer restrictions for every key, check the developer portal for any available options to limit where and how your key can be used. Some APIs allow you to specify HTTP referrers (for web apps) or IP addresses (for server-side apps) that are permitted to use a key (Cloudflare API token permissions example).

4. Implement Rate Limiting and Monitoring

• Monitor your API key usage regularly through the Open Charge Map developer portal. Be alert for unusual spikes in usage that could indicate a compromised key.
• Implement client-side rate limiting in your application to prevent accidental or malicious overuse of the API, adhering to Open Charge Map's defined rate limits.

5. Securely Manage and Rotate Keys

• Rotate keys periodically: Even if a key hasn't been compromised, rotating it on a regular schedule (e.g., every 90 days) reduces the window of exposure if a key is ever leaked.
• Revoke compromised keys immediately: If you suspect an API key has been compromised, revoke it immediately through the Open Charge Map developer portal and generate a new one.

6. Error Handling and Logging

• Implement robust error handling for API calls. Do not log API keys in plain text within your application's logs, especially in production environments. Ensure any error messages returned by the API do not expose your key.