Authentication

The Solcast API uses API keys to authenticate requests. Your API key carries full access to your account, so keep it secret and never expose it in client-side code or public repositories.

API keys

API keys are managed through the Solcast Toolkit. Each key is tied to your account and grants access to the products included within your plan.

Key formatUUID (e.g. a1b2c3d4-e5f6-...)

TransmissionHTTPS only — never send over HTTP

ScopeAccount-level access to permitted endpoints

ExpiryKeys do not expire unless revoked

Sending your API key

The recommended method is to pass your API key in the Authorization header of every request using the Bearer scheme.

Authorization: Bearer YOUR_API_KEY

Alternate: query string

If you cannot set request headers, you can pass your key as the api_key query parameter instead. Prefer the header method wherever possible — query strings may appear in server logs and browser history.

https://api.solcast.com.au/data/forecast/radiation_and_weather?api_key=YOUR_API_KEY

Requests made without a valid key, or with a key that lacks permission for the requested endpoint, will receive a 401 Unauthorizedor 403 Forbidden response.

Keeping your key secure

✓Store keys in environment variables or a secrets manager

✓Rotate keys immediately if you suspect they have been compromised

✗Never hard-code a key in source code or commit it to version control

✗Never expose a key in client-side JavaScript or mobile app bundles

✗Never share a key via email, Slack, or other messaging tools

Authentication errors

When authentication fails, the API returns one of these status codes:

401

Unauthorized

No Authorization header was provided, or the key is malformed.

403

Forbidden

The key is valid but does not have permission to access this endpoint.

Authentication examples

How to send your API key

cURL

curl "https://api.solcast.com.au/data/forecast/radiation_and_weather" \
  -H "Authorization: Bearer $API_KEY"

JavaScript

const res = await fetch(
  'https://api.solcast.com.au/data/forecast/radiation_and_weather',
  {
    headers: {
      Authorization: `Bearer ${API_KEY}`,
    },
  }
);
const data = await res.json();

Python

import requests

response = requests.get(
    "https://api.solcast.com.au/data/forecast/radiation_and_weather",
    headers={"Authorization": "Bearer API_KEY"},
)
data = response.json()

401 Unauthorized response

{
  "response_status": {
    "error_code": "Unauthorized"
  }
}