Keys and origins
MapRouter has two kinds of key. Both spend from the same account balance.
Publishable mr_pk_… |
Secret mr_sk_… |
|
|---|---|---|
| Where it goes | Frontend code and public env vars | Server env only |
| What it can call | Tiles, styles, TileJSON, autocomplete, time zones | Everything |
| Locked to origins | Yes, plus localhost on any port |
No |
| Sent as | ?key= on map URLs, or Authorization: Bearer |
Authorization: Bearer only |
Origins
A publishable key only works when the request’s Origin (or Referer) is one you listed.
List exact origins like https://shop.example, or a wildcard subdomain like
https://*.vercel.app for preview deployments. Requests from anywhere else get
403 origin_not_allowed.
Caps
Every key has a daily cap and an optional monthly cap, in credits. A new key’s daily cap
defaults to the larger of your free daily quota and a quarter of your paid balance, so one
runaway app can’t drain the account in a day. At its cap a key gets 402 key_cap_reached
while your other keys keep working. Change caps in the dashboard.
Agents can lower them with POST /v1/keys/{id}/budget, but only you can raise them.
Revoking
Revoke a key in the dashboard. It stops working within a minute.
If a key leaks
Rotate it: create a new key, deploy it, revoke the old one. Caps limit what a leaked key can spend in the meantime. Never put a secret key in a browser, a mobile app or a public repo.