Transport for Auckland Authentication: Methods & Security (2026)

Authentication overview

Transport for Auckland (AT) provides programmatic access to its public transport data through various APIs, primarily focusing on General Transit Feed Specification (GTFS) feeds and the AT Park API. Authentication is required for most API endpoints to ensure data integrity, manage access, and monitor usage. The primary method for authenticating requests to AT's developer resources involves the use of API keys, which are issued upon registration through the official AT developer portal. These keys serve as a unique identifier for your application and are essential for accessing real-time data, scheduled information, and parking availability services.

The AT authentication model is designed to facilitate straightforward integration for developers while maintaining necessary security controls. For non-commercial use, access to GTFS feeds and the AT Park API is generally free, with API key registration being the principal requirement. Commercial applications, however, may necessitate additional agreements and specific credential handling, as outlined in the Transport for Auckland developer documentation. Understanding the role of API keys and adhering to best practices for their management is crucial for securely developing applications that utilize Auckland's public transport data.

Supported authentication methods

Transport for Auckland's developer platform primarily supports API keys for authenticating requests to its range of data services. This method offers a balance of security and ease of implementation for developers integrating with public transport information.

API Keys

An API key is a unique token that identifies the requesting application or user. When you register on the AT developer portal, you are assigned an API key. This key must be included with each API request to gain access to protected resources. API keys are generally suitable for identifying a project or application rather than an individual user and are best used when the risk of key compromise is mitigated through secure storage and transmission practices. For instance, an API key might grant read-only access to public data feeds like the real-time GTFS data, which provides current information on bus, train, and ferry movements across Auckland.

The use of API keys allows Transport for Auckland to monitor API usage, enforce rate limits, and ensure fair access to data resources. While simple to implement, developers must treat API keys as sensitive credentials to prevent unauthorized access to the data.

Other potential authentication methods (not currently supported by AT)

• OAuth 2.0: While not currently a primary authentication method for AT's public data APIs, OAuth 2.0 is a common framework used for delegated authorization, allowing third-party applications to access user resources without exposing user credentials. It is often employed for services requiring user-specific data or interactions, such as payment processing APIs like Stripe's API documentation or identity services like Google's OAuth 2.0 implementation.
• Mutual TLS (mTLS): This method provides strong, two-way authentication by verifying both the client and server using digital certificates. It's typically used in highly sensitive environments requiring robust endpoint verification, often seen in financial services or internal microservices communication.

For Transport for Auckland's current offerings, developers should focus solely on the API key authentication method as detailed in their documentation.

Getting your credentials

To access Transport for Auckland's APIs, you must obtain an API key. The process is initiated through the official AT developer portal.

1. Visit the Developer Portal: Navigate to the Transport for Auckland developer website.
2. Registration: Look for a 'Register' or 'Sign Up' option. You will typically be asked to provide an email address, create a password, and agree to the terms of service. This step establishes your developer account.
3. Request API Key: Once registered, there will be a section within your developer dashboard or a specific link to 'Get an API Key' or 'Manage API Keys'. Follow the prompts to generate a new key.
4. Key Provisioning: The system will generate a unique API key for your application. This key is a long string of alphanumeric characters.
5. Store Your Key Securely: Immediately after generation, copy and store your API key in a secure location. It is crucial to treat this key as sensitive information, similar to a password. Do not hardcode it directly into your application's source code, especially for client-side applications or publicly accessible repositories.
6. Activate (if required): In some cases, a newly generated API key might require activation or association with specific API products. Check the developer portal instructions for any additional steps.
7. Commercial Use: If your intended use is commercial, the Transport for Auckland portal states that you are required to contact them directly. This may involve a separate agreement and distinct credentialing process compared to non-commercial access.

The API key acts as your passport to the AT APIs, identifying your application and authorizing requests. Ensure you understand the terms of use associated with your key, particularly regarding rate limits and data distribution policies, which are detailed on the AT developer website.

Authenticated request example

When making requests to Transport for Auckland APIs that require authentication, you will typically include your API key in the request headers. Below is an example demonstrating how to make an authenticated request using the curl command-line tool, a common method for interacting with web services.

Let's assume you want to retrieve data from a hypothetical AT API endpoint, and your API key is YOUR_AT_API_KEY_GOES_HERE.

Example curl request with API Key in Header

curl -X GET \
  'https://api.at.govt.nz/v2/gtfs/routes?api_key=YOUR_AT_API_KEY_GOES_HERE' \
  -H 'Accept: application/json'

Explanation of the example:

• curl -X GET: Specifies that this is an HTTP GET request to retrieve data.
• 'https://api.at.govt.nz/v2/gtfs/routes?api_key=YOUR_AT_API_KEY_GOES_HERE': This is the target URL for the API endpoint. In this example, the API key is passed as a query parameter named api_key. Note: While query parameters are shown here for illustration, Transport for Auckland's specific documentation at their developer portal will confirm the exact method of key transmission (e.g., query parameter, custom header like Ocp-Apim-Subscription-Key, or standard Authorization header). Always refer to the official documentation for the precise implementation.
• -H 'Accept: application/json': This header informs the API that the client prefers to receive the response in JSON format.

For client-side JavaScript applications, you might use the fetch API:

fetch('https://api.at.govt.nz/v2/gtfs/routes?api_key=YOUR_AT_API_KEY_GOES_HERE', {
  method: 'GET',
  headers: {
    'Accept': 'application/json'
  }
})
.then(response => response.json())
.then(data => console.log(data))
.catch(error => console.error('Error:', error));

Important Considerations:

• Actual API Key Parameter/Header: Always consult the official Transport for Auckland API documentation for the exact name of the query parameter or HTTP header used to transmit the API key. It might be api_key, x-api-key, Ocp-Apim-Subscription-Key, or another specific header.
• Secure Storage: In production environments, never hardcode your API key directly into your application. Instead, use environment variables, a secrets management service (e.g., AWS Secrets Manager or Google Cloud Secret Manager), or a configuration file that is not committed to version control.
• Rate Limits: Be aware of any rate limits imposed by Transport for Auckland. Exceeding these limits can lead to temporary blocking of your API key.

Security best practices

Securing your API keys and calls to Transport for Auckland's APIs is crucial to protect your application, prevent unauthorized access, and ensure compliance with terms of service. Adhering to these best practices will help maintain the integrity of your integrations.

API Key Management

• Do Not Embed in Public Client-Side Code: Never hardcode API keys directly into public repositories, client-side JavaScript, or mobile applications where they can be easily extracted. If an API key is exposed, it can be used by malicious actors to impersonate your application, leading to unauthorized data access, abuse of rate limits, and potential service interruptions for your legitimate users.
• Use Environment Variables or Secret Management: For server-side applications, store API keys as environment variables. This prevents the key from being committed to version control systems like Git. For more complex deployments or microservices architectures, consider using dedicated secret management services such as AWS Secrets Manager, Google Cloud Secret Manager, or HashiCorp Vault. These services provide secure storage, rotation, and access control for sensitive credentials.
• Restrict Key Permissions: If Transport for Auckland's API platform offers fine-grained permission control for API keys (e.g., read-only vs. read/write), always grant the minimum necessary permissions required for your application's functionality. This principle of least privilege limits the damage if a key is compromised. Always consult the AT developer documentation for available permission scopes.
• Regular Key Rotation: Periodically rotate your API keys. This practice limits the window of opportunity for a compromised key to be exploited. While Transport for Auckland's developer portal may or may not offer automated rotation, manually generating a new key and updating your applications is a good practice.
• Monitor API Usage: Regularly check your API usage statistics through the Transport for Auckland developer dashboard (if available). Unusual spikes in usage or calls from unexpected IP addresses could indicate a compromised key.

Secure Communication

• Always Use HTTPS: Ensure all API requests are made over HTTPS. This encrypts the communication channel between your application and the Transport for Auckland API servers, protecting your API key and transmitted data from eavesdropping during transit. The base URLs provided by AT (e.g., https://api.at.govt.nz/) indicate that HTTPS is the standard.
• Validate SSL Certificates: Your application should be configured to validate SSL/TLS certificates of the API server. This prevents man-in-the-middle attacks where an attacker might try to impersonate the AT API server. Most modern HTTP client libraries handle this by default, but it's important to ensure it's not disabled.

Error Handling and Logging

• Avoid Logging Sensitive Data: Configure your application's logging mechanisms to prevent API keys or other sensitive authentication details from being written to logs. Logs can often be accessed by various personnel and may not have the same level of security as your application's runtime environment.
• Graceful Error Handling: Implement robust error handling for API calls. For authentication failures, return generic error messages to clients (e.g., "Authentication failed") rather than specific details that could aid an attacker in probing your system.

By implementing these security best practices, developers can build more resilient and secure applications leveraging Transport for Auckland's valuable public transport data.