Back to news

Security with short-lived tokens

22. 10. 2026

Short-lived tokens offer another way to reduce the risk of unauthorized use of the Mapy.com API. Each token is valid for just 15 minutes, limiting the time it can be misused if copied.

This security method requires your own server and cannot be implemented solely on the client side. Your server uses a project secret to request a token from the Mapy.com API and passes it to your application. Both the secret and the permanent API key remain on the server. The application then uses the token to call map services directly and requests a new one from your server before it expires.

Tokens inherit the restrictions configured for their API key. In the key settings, you can allow token access and then make it mandatory. This prevents calls to the services using the API key alone.

For setup details and usage examples, see the article Short-lived tokens.