Transport for London API Authentication: Key Management (2026)

Authentication overview

The Transport for London (TfL) API provides programmatic access to a range of public transport data, including live line statuses, journey planning tools, and disruption alerts. To ensure secure and managed access to these resources, all requests to the TfL API must be authenticated. The primary method for authentication involves the use of API keys, which are issued upon successful registration on the official TfL API portal. These keys serve as a unique identifier for your application and are used by the TfL API to verify your authorization to access requested data. Proper management and protection of these API keys are crucial for maintaining the security and integrity of your application and its interaction with TfL services.

The authentication mechanism is designed to be straightforward for developers while adhering to security best practices. By requiring API keys, TfL can monitor usage, prevent unauthorized access, and ensure fair resource allocation across various applications utilizing its data. Developers are advised to familiarize themselves with the specific requirements for including API keys in their requests, as detailed in the TfL API account creation guide.

Supported authentication methods

The Transport for London API primarily supports API key authentication for accessing its public data feeds. This method is widely adopted for its simplicity and effectiveness in managing access to web services. An API key is a unique string that identifies your project or application when interacting with the API. While other authentication methods like OAuth 2.0 are common in various APIs for user authorization, the TfL API focuses on application-level authentication through API keys for its publicly available datasets.

API Key Authentication

API key authentication involves including a unique key in each request to the TfL API. This key acts as a token that verifies the identity of the calling application. It is generally passed as a query parameter or within a custom HTTP header. The TfL API documentation specifies the exact method for including your API key in requests, typically requiring both an app_id and app_key.

The table below outlines the primary authentication method supported by the TfL API:

For a deeper understanding of API key security, the Cloudflare API Shield documentation on API keys provides useful insights into protecting these credentials.

Getting your credentials

To begin using the Transport for London API, you must first register an account and obtain your API credentials. The process is designed to be straightforward, ensuring developers can quickly gain access to the necessary data feeds.

Step-by-step guide to obtaining TfL API keys:

1. Visit the TfL API Portal: Navigate to the TfL API account creation page. This is the central hub for developers to register and manage their API access.
2. Register for an Account: You will need to provide basic information to create a new developer account. This typically includes your name, email address, and details about your intended use of the API.
3. Agree to Terms and Conditions: Before gaining access, you will be required to review and accept the TfL API terms of use. It is important to read these carefully to understand the usage policies, rate limits, and data governance.
4. Generate API Keys: Once your account is successfully registered and activated, you will be able to generate your unique app_id and app_key. These keys are crucial for authenticating your requests. The portal typically provides a dashboard where you can view and manage your generated keys.
5. Record Your Credentials: It is essential to securely record your app_id and app_key immediately after generation. These keys are sensitive and should be treated with the same care as passwords. Do not share them publicly or embed them directly into client-side code.
6. Understand Usage Limits: The TfL API offers free access for standard usage, but there might be rate limits associated with your API keys. If your application requires higher volumes of requests, you may need to contact TfL directly to discuss expanded access options. Details on rate limits are typically provided within the API portal or the TfL API reference documentation.

Once you have your app_id and app_key, you are ready to integrate them into your application's API calls. The TfL API documentation provides examples for various endpoints, demonstrating how to properly include these credentials.

Authenticated request example

After obtaining your app_id and app_key from the TfL API portal, you can include them in your API requests to authenticate. The TfL API typically expects these credentials as query parameters in the URL. Below is an example of an authenticated request using a hypothetical endpoint to retrieve the status of a specific London Underground line (e.g., the Central Line).

Example: Fetching Central Line status

Consider an endpoint like /Line/central/Status. To authenticate this request, you would append your app_id and app_key as query parameters.

GET https://api.tfl.gov.uk/Line/central/Status?app_id=YOUR_APP_ID&app_key=YOUR_APP_KEY HTTP/1.1
Host: api.tfl.gov.uk

Replace YOUR_APP_ID and YOUR_APP_KEY with your actual credentials.

Using cURL for an authenticated request:

You can test an authenticated request using the curl command-line tool. This example demonstrates how to make a GET request to retrieve line status information for the Central Line, including your API credentials.

curl -X GET \
  'https://api.tfl.gov.uk/Line/central/Status?app_id=YOUR_APP_ID&app_key=YOUR_APP_KEY' \
  -H 'Accept: application/json'

This command will send an HTTP GET request to the specified TfL API endpoint, including your application ID and key. The -H 'Accept: application/json' header indicates that you prefer a JSON response, which is common for the TfL API. For more detailed examples and specific endpoint usage, refer to the TfL API Reference.

Security best practices

Securing your API keys and managing authentication properly is paramount to protect your application and ensure uninterrupted access to the Transport for London API. Adhering to these best practices will help mitigate common security risks.

1. Do Not Hardcode API Keys: Avoid embedding your app_id and app_key directly into your source code, especially for client-side applications (like JavaScript in a browser or mobile apps). Hardcoding makes keys easily extractable. Instead, use environment variables for server-side applications or secure configuration management tools. For client-side applications, consider proxying requests through your own backend server to inject the keys securely.
2. Use Environment Variables: For server-side applications, store your API keys as environment variables. This keeps them out of your codebase and allows for easy rotation and management without code changes. Most programming languages and deployment environments support environment variables.
3. Restrict Key Usage (if applicable): While the TfL API primarily uses a single key pair for general access, if an API offers features to restrict keys by IP address or HTTP referrer, always apply the narrowest possible restrictions. This limits the impact if a key is compromised.
4. Secure Communication (HTTPS): Always ensure that all communications with the TfL API are conducted over HTTPS. The TfL API endpoints are served over HTTPS by default, which encrypts data in transit, protecting your API keys and sensitive data from eavesdropping. Using HTTPS is a fundamental security practice for any web-based communication, as highlighted by resources like the Mozilla Developer Network's guide on HTTPS.
5. Monitor API Usage: Regularly monitor your API usage logs for any unusual activity. Spikes in requests, requests from unexpected locations, or errors indicating unauthorized access could signal a compromised key. The TfL API portal may offer tools or dashboards for monitoring.
6. Rotate API Keys: Periodically rotate your API keys. This means generating new keys and deprecating old ones. Regular rotation reduces the window of opportunity for a compromised key to be exploited. Establish a schedule for key rotation as part of your application's security policy.
7. Error Handling: Implement robust error handling in your application to gracefully manage authentication failures. Avoid exposing detailed error messages that might reveal information about your API key or application logic to potential attackers.
8. Review Access Permissions: Regularly review who has access to your API keys within your development team or organization. Limit access to only those individuals who require it for their roles.
9. Client-Side Considerations: If you are building a client-side application (e.g., a mobile app or a single-page application) that directly calls the TfL API, be aware that API keys embedded in client-side code can be extracted. For enhanced security, consider routing all API requests through your own secure backend server, which can then inject the API keys before forwarding the request to TfL. This prevents the keys from being exposed to end-users.

By implementing these security best practices, developers can significantly enhance the protection of their applications and ensure a secure interaction with the Transport for London API.