---
title: "Authentication | Guides"
description: "Choose between an API key and a service token."
---

> For AI agents: a documentation index is available at [/llms.txt](https://docs.maptiler.com/llms.txt). Markdown versions of all pages are available by appending .md to any URL.

# Authentication

Every request to a MapTiler API needs to identify who’s making it. You do this with one of two credentials: an **API key** or a **service token**.

## API key

An API key is a string you can expose publicly once you secure it. Use it for anything that runs where users can see it: websites, mobile apps, desktop apps. It also works for calling MapTiler’s [public APIs](https://docs.maptiler.com/cloud/api/) from your own backend, when standard security and simple setup matter more to you than maximum protection.

👉 [Use an API key](https://docs.maptiler.com/guides/credentials/api-key/)

## Service token

A service token must never be exposed publicly. Use it only from a backend you control, in two situations:

-   To access your MapTiler account and resources (datasets, API keys, analytics) through our [Service API](https://docs.maptiler.com/cloud/admin-api/). _This always requires a service token._
-   As a stronger alternative to an API key, when you’re calling MapTiler’s [public APIs](https://docs.maptiler.com/cloud/api/) from your own backend and you want the best security, at the cost of some setup effort. In this case, the token _signs_ each request instead of being sent directly.

👉 [Use a service token](https://docs.maptiler.com/guides/credentials/service-token/)