Core concepts

Authentication

One bearer token on every request. No OAuth dance, no signing, no expiry to manage.

Send the key as a bearer token

Create a key in your dashboard, then send it in the Authorization header. Keys do not expire. They are revocable at any time, and revocation takes effect immediately.

Request

curl "https://emergencyapi.com/api/v1/incidents?state=vic" \
  -H "Authorization: Bearer YOUR_API_KEY"

What needs a key

Authenticated: Every data endpoint: incidents, events, declarations, gauges and states. A request without a key returns 401 before any database work happens.
Public: /status, /attribution and /schema. Health, source credits and the enum vocabulary are deliberately open so you can inspect them before signing up.

Keep your key server side

A key in browser JavaScript is a key you have published. The safe pattern is to call the API from your own backend and pass the result to the browser.

If you genuinely need to call from the browser, restrict the key to your own origins in the dashboard. A restricted key presented from any other site is rejected with 403. Requests that send no Origin header at all, which is every server-side caller, are never blocked by this, so turning it on cannot break your backend.

Origins are matched exactly, scheme and host and port. Add each one you use: https://example.com does not cover https://www.example.com.

If a key leaks

Revoke it in the dashboard and create a new one. There is no rotation window to wait out, and usage already recorded against the old key stays on your account for the month. See rate limits for how that quota behaves.