Storm Glass Authentication Guide (2026)

Authentication overview

Storm Glass provides marine weather data through a RESTful API, requiring authentication to manage access control, track usage against subscription plans, and secure data endpoints. The primary method for authenticating requests to the Storm Glass API involves using an API key. This key identifies the client making the request and ensures that only authorized applications can retrieve forecast and historical weather information.

API keys are a common authentication mechanism for web services due to their simplicity and ease of implementation. When an API key is included in an HTTP request, the Storm Glass server verifies its validity and permissions before processing the request. This system supports usage limits associated with different Storm Glass pricing plans, from the free Developer Plan to various paid tiers, ensuring fair use and service reliability.

Developers interacting with the API can integrate authentication directly into their applications, often by adding the API key to request headers. This approach is compatible with various programming languages and development environments, including the official Storm Glass Python and Node.js SDKs, which abstract some of the underlying HTTP request details for convenience.

Supported authentication methods

The Storm Glass API primarily supports API Key authentication. This method is suitable for client-server communication where the client is a trusted application or where the API key can be securely stored and transmitted.

API keys function as a unique identifier for your application and are linked to your Storm Glass account. They enable the API to identify that a request originates from an authorized source and to enforce any rate limits or access permissions associated with your subscription. For securing API keys in transit, Storm Glass mandates the use of HTTPS, which encrypts the communication channel, protecting the key from interception during transmission. For a broader understanding of API key security, the Google Cloud API keys documentation offers insights into best practices for managing and securing API keys across various services.

Getting your credentials

To access the Storm Glass API, you must first obtain an API key. This process typically involves registering for an account and then generating the key through your developer dashboard.

1. Sign Up/Log In: Navigate to the Storm Glass homepage and either sign up for a new account or log in to an existing one. New users are typically granted access to the Developer Plan, which includes 50,000 requests per month.
2. Access Developer Dashboard: Once logged in, locate your developer dashboard or account settings. This area is usually where API keys are managed.
3. Generate API Key: Look for a section related to API keys, credentials, or access tokens. There should be an option to generate a new API key. Follow any on-screen instructions to create the key.
4. Copy Your API Key: After generation, your API key will be displayed. It is crucial to copy this key immediately and store it securely, as it may not be displayed again for security reasons. Treat your API key like a password.
5. Review Usage Limits: Familiarize yourself with the usage limits associated with your account plan. The Storm Glass pricing page details the number of requests permitted for each tier.

For detailed, step-by-step instructions with screenshots, refer to the official Storm Glass documentation on getting started and authentication.

Authenticated request example

Once you have your API key, you can include it in your API requests. The Storm Glass API expects the API key to be sent in the Authorization HTTP header, prefixed with X-Api-Key. Here's an example using curl and then a Python example.

cURL Example

This curl command demonstrates how to fetch marine weather data for a specific location using your API key.

curl -H "Authorization: X-Api-Key YOUR_API_KEY" \
     "https://api.stormglass.io/v2/weather/point?lat=58.7984&lng=17.8081¶ms=waveHeight,waterTemperature"

Replace YOUR_API_KEY with your actual API key obtained from your Storm Glass account.

Python Example

For Python developers, the following code snippet shows how to make an authenticated request using the requests library.

import requests

api_key = "YOUR_API_KEY" # Replace with your actual Storm Glass API key
lat = 58.7984
lng = 17.8081
params = "waveHeight,waterTemperature"

headers = {
    'Authorization': f'X-Api-Key {api_key}'
}

url = f"https://api.stormglass.io/v2/weather/point?lat={lat}&lng={lng}¶ms={params}"

response = requests.get(url, headers=headers)

if response.status_code == 200:
    data = response.json()
    print("Successfully fetched weather data:")
    print(data)
else:
    print(f"Error fetching data: {response.status_code} - {response.text}")

This example demonstrates setting the Authorization header with the API key before making the GET request. The Storm Glass documentation provides additional examples for other programming languages and specific API endpoints.

Security best practices

Securing your API key is essential to prevent unauthorized access to your Storm Glass account and to avoid exceeding your usage limits through malicious activity. Adhering to these best practices can help maintain the integrity of your application and data.

• Keep API Keys Confidential: Never hardcode API keys directly into public client-side code (e.g., JavaScript in a web browser) or commit them to version control systems like Git without proper encryption or exclusion (e.g., using .gitignore). For client-side applications, consider using a backend proxy server to make API calls, thus keeping the key on the server.
• Use Environment Variables: Store API keys as environment variables on your server or in secure configuration files. This prevents them from being exposed in your codebase and makes it easier to manage different keys for development, staging, and production environments.
• Restrict API Key Usage (if applicable): While Storm Glass API keys are general-purpose for your account, if the API were to offer features for IP address restrictions or HTTP referrer restrictions, configuring these would add an extra layer of security. Always check Storm Glass's latest documentation for any new security features that can be enabled.
• Use HTTPS/TLS: Always ensure that your API requests are made over HTTPS. This encrypts the communication channel between your application and the Storm Glass servers, protecting your API key and data from eavesdropping during transit. Storm Glass mandates HTTPS for all API calls.
• Rotate API Keys: Periodically generate new API keys and deprecate old ones. This practice minimizes the risk associated with a compromised key, as its validity period will be limited. If you suspect an API key has been compromised, revoke it immediately through your Storm Glass developer dashboard and generate a new one.
• Monitor Usage: Regularly monitor your API key's usage through your Storm Glass account dashboard. Unusual spikes in requests or requests from unexpected locations could indicate a compromised key.
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures (e.g., 401 Unauthorized errors). This prevents your application from crashing and can provide insights into potential security issues.
• Least Privilege: If Storm Glass were to offer granular permissions for API keys, assign only the necessary permissions to each key. This principle of least privilege ensures that even if a key is compromised, the scope of potential damage is limited. Refer to the official Storm Glass API documentation for updates on permission management.