Machine-readable: manifest · index · English Markdown
Draft translation: this English page is available for review and is not yet the production default.
Credentials and keys
01Spatial separates who is calling from which resource is targeted.
| Credential | Purpose | Location |
|---|---|---|
| API Key | Identifies the API user and its permissions. | Portal profile. |
| Map Key | Encrypted handle for one map. | Ready map card. |
| Project Key | Targets all maps in a Project. | Project information in Spatial Maps. |
| Login token | Browser session for Portal management. | Managed by Portal; never copy it into a client. |
Use api_key + map_key for a specific map or api_key + project_key for Project-wide localization; never send both targets. The API Key must be authorized for the resource.
Keep keys out of public repositories, logs, analytics, screenshots, and ordinary URLs. Use separate environment keys. Regenerating an API Key invalidates the previous value immediately, so inventory and roll out every dependent client before rotation. Map transfer preserves the Map Key, but the accessing API Key must belong to the new owner.