Authentication

One key, sent in a header. There is no OAuth flow and no token to refresh.

Headers

Either is accepted. If both are present, Authorization wins.

http

Authorization: Bearer brf_xxxxxxxxxxxx
X-API-Key: brf_xxxxxxxxxxxx

Key format

Keys are brf_ followed by 43 URL-safe base64 characters — 256 bits of randomness. Match them with ^brf_[A-Za-z0-9_-]{43}$ if you are scanning your own logs for leaks.

Storage

Only a SHA-256 of the key is stored, alongside the first eight characters so a key can be identified in a list. Nobody can read your key back to you, including us — lose it and you issue another.

Rotating and revoking

Issue a new key, deploy it, then ask for the old one to be revoked. There is no self-serve revoke endpoint yet; open an issue on the repository with the key prefix — the first eight characters, never the whole key.

Keeping it out of your repository

The key is a bearer credential: anyone holding it spends your quota. Read it from the environment rather than a literal, and keep it off the browser — a key in client-side JavaScript is a key you have published.

bash

export BRF_KEY="brf_..."        # shell
BRF_KEY=brf_...                 # .env, git-ignored

If you need Barcelona figures in a browser app, call the API from your own server and cache the response — the data changes once a quarter, so a long cache costs you nothing in freshness.

NextEndpoints →