Beta

Keys and security

Today: live since 11 November 2026. Map tiles and styles still load without a key until a date announced in the changelog.

Web services on maps-api.ranamaps.com always need a key.
Map files (styles, tiles, fonts) need a key too. Requests without one are refused once the switch is made (decision 0017); the SDKs always send your key.
route.ranamaps.com is for Rana's own apps. Other websites are refused there. Use directions with your key instead.

Two kinds of key

	Public key `pk_live_…`	Secret key `sk_live_…`
Where	Web page, Android app, iPhone app	Your server only
Limited to	The web origins, Android apps or iOS bundle ids you name (at least one)	Not limited by origin or app
Safe in client code	Yes	No. Sent from a browser, it is refused
Shown	Once	Once

A public key is abuse control, not a password. Anyone can copy it out of your page or app, and requests can be faked outside a browser. That is why it only works from the places you name, and why limits apply to your organisation.

Sending a key

Send it in the X-Rana-Key header. Our SDKs do this for you.

curl "https://maps-api.ranamaps.com/v1/geocode/reverse?lat=6.5244&lng=3.3792" \
  -H "X-Rana-Key: $RANA_SECRET_KEY"
# The answer carries "attribution": "© Rana Maps © OpenStreetMap".

You may also send it as ?key= in the address. The header is better: an address can end up in browser history, logs and the Referer header of other sites. If you send both and they differ, the request is refused with conflicting_keys.

How a public key is matched

Platform	What you name in Studio	What the request must show
Web	Origins, for example `https://www.example.com`	The browser's `Origin` header
Android	Package name and the SHA-256 of the signing certificate (for Google Play, the Play App Signing certificate)	`X-Rana-Android-Package` and `X-Rana-Android-Cert`, sent by the Android SDK
iOS	Bundle id, for example `com.example.app`	`X-Rana-Ios-Bundle`, sent by the iOS SDK

A public key with no matching origin, package or bundle id is refused with client_not_allowed, or no_client_identity if nothing was sent.

Check a key

GET /v1/key tells you which organisation a key belongs to, its plan and its limits. It is free.

curl https://maps-api.ranamaps.com/v1/key -H "X-Rana-Key: $RANA_SECRET_KEY"

{
  "organisation_id": "7c1e…",
  "key": { "id": "51a9…", "kind": "secret" },
  "plan": "trial",
  "limits": {
    "per_minute": { "routing": 60, "matrix": 1000, "search": 60, "static": 30 },
    "per_day": { "directions": 2000, "matrix": 10000, "roads": 1000, "geocoding": 2000, "places": 2000, "static_maps": 500 }
  },
  "attribution": "© Rana Maps © OpenStreetMap"
}

Scopes

A key holds scopes for the products it may use: tiles, styles, directions, matrix, roads, geocoding, places and static_maps. New keys get all of them. Remove the ones you do not need. A request outside the key's scopes is refused with scope_not_allowed.

Keeping keys safe

Never put a secret key in a web page, an app, a public repository or a screenshot.
Keep secret keys in your server's secret store, not in code.
Use one key per app or server, so you can revoke one without stopping the others.
If a key leaks, revoke it in Studio at once and make a new one. Rana stores only a hash, so a lost key cannot be shown again.
An organisation can hold up to 20 active keys.

What Rana does with your key

Keys are removed from all our logs. Only the first 8 characters (the prefix shown in Studio) may appear.
Rana stores a SHA-256 hash of each key, never the key itself.
You are responsible for requests made with your keys.