Authentication

Every request to a MapTiler API needs to identify who’s making it. You do this with one of two credentials: an API key or a service token.

API key

An API key is a string you can expose publicly once you secure it. Use it for anything that runs where users can see it: websites, mobile apps, desktop apps. It also works for calling MapTiler’s public APIs from your own backend, when standard security and simple setup matter more to you than maximum protection.

👉 Use an API key

Service token

A service token must never be exposed publicly. Use it only from a backend you control, in two situations:

• To access your MapTiler account and resources (datasets, API keys, analytics) through our Service API. This always requires a service token.
• As a stronger alternative to an API key, when you’re calling MapTiler’s public APIs from your own backend and you want the best security, at the cost of some setup effort. In this case, the token signs each request instead of being sent directly.

👉 Use a service token