Transport for Bordeaux, France Authentication Guide (2026)

Authentication overview

Transport for Bordeaux, France (TBM) provides public transit data through the Bordeaux Métropole open data portal. Unlike many commercial API services that require explicit authentication mechanisms such as API keys or OAuth 2.0 tokens, TBM's data is made available under an open data model. This means that direct authentication, in the technical sense of verifying a user's identity or application's credentials for access, is not a prerequisite for retrieving the data. Developers and data consumers can access the datasets, including both static GTFS (General Transit Feed Specification) and real-time GTFS-RT feeds, without registering an application or obtaining specific access tokens. This model aims to foster broader use and integration of public transit information for applications related to real-time transit, urban planning, and mobility research.

The absence of a traditional authentication layer simplifies the process for data retrieval but places the responsibility on the data consumer to adhere to any usage policies or licensing terms associated with the Bordeaux Métropole open data initiative. While direct authentication is not required, users typically interact with the data through direct downloads or by making HTTP requests to publicly exposed endpoints, relying on standard web protocols rather than authenticated API calls. This approach is consistent with many government-backed open data initiatives globally, promoting transparency and accessibility for public datasets.

Supported authentication methods

Transport for Bordeaux, France's open data platform does not employ traditional authentication methods such as API keys, OAuth 2.0, or mTLS for accessing its public transit data. This is a deliberate choice consistent with its open data policy, aiming to maximize accessibility for developers and researchers. Consequently, there are no specific authentication mechanisms to configure or manage when working with TBM data.

The primary method of accessing the data is via direct HTTP/HTTPS requests to the provided URLs on the Bordeaux Métropole open data portal. These URLs facilitate direct download of GTFS static files and consumption of GTFS-RT real-time feeds. The security of data transmission relies on standard web protocols (HTTPS) to ensure data integrity during transit.

Authentication methods overview

This public access model removes the overhead associated with credential management and rotation, often found in APIs requiring methods like API key authentication or the more complex OAuth 2.0 flow. For instance, processes involving generating access tokens, refreshing expired tokens, or securely storing client secrets, as detailed in the OAuth 2.0 Authorization Framework, are not relevant for TBM's open data. Similarly, managing secret API keys, which is a common practice for services like Stripe's API keys, is not required here.

The security considerations shift from authenticating individual requests to ensuring the integrity of the data source and the secure transfer of data over the internet via HTTPS, which encrypts communications between the client and server. This ensures that the data cannot be intercepted or modified in transit, a fundamental aspect of secure web communication as specified by the World Wide Web Consortium (W3C) on web security.

Getting your credentials

As Transport for Bordeaux, France (TBM) provides its data under an open data model, there are no specific credentials (such as API keys, client IDs, or client secrets) that users need to obtain. This means developers do not need to go through a registration process, apply for access, or manage any form of authentication tokens to begin using the data. The data is freely available for direct access.

To access the data, you simply need to navigate to the official Bordeaux Métropole Open Data Portal. On this portal, you will find links to download static GTFS datasets and access endpoints for real-time GTFS-RT feeds. The process is typically:

1. Locate the Dataset: Browse the portal to find the specific TBM public transport datasets you require (e.g., 'Réseau TBM - Arrêts' for stops, or 'Réseau TBM - Temps Réel' for real-time data).
2. Identify Access Method: For static data, there will often be a direct download button or a link to a file. For real-time data, an API endpoint (a URL) will be provided that you can query using standard HTTP requests. You can find detailed information on how to access the data directly on the Bordeaux Métropole data portal documentation.
3. Consent to Usage Terms (Implicit): While no explicit credential exchange occurs, by accessing and using the data, you are generally assumed to agree to the open data license terms and conditions specified by Bordeaux Métropole. It is crucial to review these terms to ensure compliance with legal obligations regarding data usage, redistribution, and attribution. These terms are typically linked or explained on the dataset's information page within the portal.

This streamlined approach significantly reduces the barrier to entry for developers and researchers, allowing immediate programmatic access to public transit information without the typical setup time required for authenticated APIs.

Authenticated request example

Given that Transport for Bordeaux, France's data does not require authentication, there are no specific authentication headers or parameters to include in your requests. Accessing the data involves making standard HTTP GET requests to the publicly available URLs provided by the Bordeaux Métropole Open Data Portal.

Example: Accessing a GTFS-RT (Real-time) Feed

This example demonstrates how to retrieve data from a hypothetical GTFS-RT feed endpoint. The actual URL for a real-time feed would be found on the Bordeaux Métropole Open Data Portal's dataset page.

Using curl (Command Line)

curl -X GET "https://data.bordeaux-metropole.fr/api/explore/v2.1/catalog/datasets/reseau-tbm-temps-reel/records?limit=100" \
     -H "Accept: application/json"

Explanation:

• curl -X GET: Specifies an HTTP GET request.
• "https://data.bordeaux-metropole.fr/api/explore/v2.1/catalog/datasets/reseau-tbm-temps-reel/records?limit=100": This is a placeholder for an actual endpoint URL for real-time data. The limit=100 parameter is an example of a query parameter to retrieve a specific number of records, which might be supported by the public API.
• -H "Accept: application/json": Sets the Accept header, requesting the response in JSON format. The actual format may vary depending on the specific GTFS-RT endpoint (e.g., Protocol Buffers is common for GTFS-RT, but JSON might be offered for convenience).

Using Python requests Library

import requests

url = "https://data.bordeaux-metropole.fr/api/explore/v2.1/catalog/datasets/reseau-tbm-temps-reel/records"
params = {
    "limit": 100
}
headers = {
    "Accept": "application/json"
}

try:
    response = requests.get(url, params=params, headers=headers)
    response.raise_for_status() # Raise an HTTPError for bad responses (4xx or 5xx)

    data = response.json()
    print("Successfully retrieved data:")
    # For a GTFS-RT feed, the structure will be specific to it.
    # This just prints the first few items for demonstration.
    if data and "results" in data:
        for item in data["results"][:5]:
            print(item)
    else:
        print("No results found or unexpected data format.")

except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

Explanation:

• The Python requests library is used for making HTTP requests.
• url, params, and headers are defined to construct the request.
• response.raise_for_status() checks for HTTP error codes.
• response.json() parses the JSON response.
• Since GTFS-RT data is often in Protocol Buffers format, developers might need to use a GTFS-RT Protocol Buffers library (e.g., gtfs_realtime_pb2) to parse the binary data correctly if the endpoint does not offer a JSON alternative. This example assumes a JSON-formatted response for simplicity, which some open data portals may provide as a convenience layer. Always consult the specific dataset's documentation on the Bordeaux Métropole portal for the exact data format and access URL.

These examples illustrate that, in the absence of authentication, interacting with Transport for Bordeaux, France's open data is similar to interacting with any publicly accessible web resource.

Security best practices

While Transport for Bordeaux, France's data does not require authentication, there are still important security and operational best practices to consider when consuming and utilizing the open data:

1. Use HTTPS for all data access: Always ensure that the URLs you use to access the data begin with https://. This encrypts the communication between your application and the Bordeaux Métropole server, protecting the integrity and confidentiality of the data in transit from eavesdropping or tampering. Although the data itself is public, secure transmission is fundamental to reliable data consumption.
2. Validate Data Integrity: Even without authentication, verify the integrity of the data you receive. For GTFS and GTFS-RT feeds, this can involve checking file checksums (if provided), validating against the GTFS specification, or implementing checks for expected data formats and ranges. Unexpected data structures or missing fields could indicate issues with the source or transmission.
3. Adhere to Usage Policies and Licensing: Review and comply with the specific open data license provided by Bordeaux Métropole. These licenses often stipulate how the data can be used, shared, and attributed. Non-compliance, while not a technical security issue, can lead to legal issues. These policies are typically found on the Bordeaux Métropole data portal.
4. Implement Robust Error Handling and Rate Limiting: While there are no explicit API rate limits enforced through authentication, it's a best practice to implement client-side rate limiting and error handling in your applications. This prevents your application from making excessive requests that could overwhelm the data source or lead to your IP being temporarily blocked by generalized server-side protections. Handle network errors, unexpected HTTP responses (e.g., 404, 500), and malformed data gracefully.
5. Regularly Check for Data Updates: For real-time feeds, establish a reasonable polling interval that balances data freshness with server load. For static data, periodically check the portal for updated file versions.
6. Protect Your Infrastructure: Even if client-side authentication isn't needed, ensure the infrastructure hosting your application (servers, databases, network) is secure. This includes regular security patching, strong access controls, and network segmentation to protect against general cyber threats.
7. Privacy Considerations: If you combine TBM data with other datasets that might contain personal information (e.g., user location data from your own application), ensure you comply with relevant data protection regulations like GDPR, especially concerning data storage, processing, and user consent. The Mozilla Developer Network provides resources on web privacy that can offer guidance.

By following these best practices, developers can ensure responsible, reliable, and secure consumption of Transport for Bordeaux, France's valuable open transit data.