Authenticate your requests | Topolab Help Center

API keys for machine access

Topolab has two authentication paths. Machines and data access use API keys sent in the X-API-Key header; human sign-in is passwordless (magic link). Send the key on every data request:

curl -H "X-API-Key: tlb_prod_..." \
  "https://api.topolab.nl/v1/dataset/nl-domino-poi/files/geojson"

Permissions and licenses gate data
API access itself is free on every plan. Dataset downloads and coordinates additionally need the read permission and an active license for that dataset. OGC collections and features, and historical archives, are Team / Enterprise plan capabilities. A key that lacks the required permission — or that has no active license for the dataset — returns 403.

Bearer tokens for account endpoints

Account, organization, billing, and Data Studio endpoints are called on behalf of a signed-in user with a Bearer JWT obtained by signing in through the portal. Use API keys — not Bearer tokens — for unattended, server-to-server data access.

curl -H "Authorization: Bearer eyJhbGci..." \
  "https://api.topolab.nl/v1/organization/me"

Tip · Keep keys out of source
Treat keys like passwords. Load them from an environment variable, never commit them, and rotate on a schedule (and immediately if a key may be exposed).