Authentication

Getting Your API Key

1. Sign in with your email (we'll send a magic link)
2. Visit your API Keys dashboard
3. Click "Generate API Key"
4. Copy your key (you can only see it once!)

Using Your API Key

Include your API key in the X-API-Key header with every request:

curl -H "X-API-Key: mv_live_your_key_here" \
  "https://api.marsvista.dev/api/v2/photos?per_page=5"

JavaScript Example

const response = await fetch(
  'https://api.marsvista.dev/api/v2/photos?per_page=5',
  {
    headers: {
      'X-API-Key': process.env.MARS_VISTA_API_KEY
    }
  }
);
const data = await response.json();

Python Example

import requests
import os

response = requests.get(
    'https://api.marsvista.dev/api/v2/photos',
    params={'per_page': 5},
    headers={'X-API-Key': os.environ['MARS_VISTA_API_KEY']}
)
data = response.json()

API Key Format

Mars Vista API keys follow this format:

mv_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• mv_ - Mars Vista prefix
• live_ - Live/production key
• xxxxx... - 40-character random string

Total length: 47 characters

Rate Limits

All accounts have the following rate limits:

Rate Limit Headers

Every response includes rate limit headers:

X-RateLimit-Limit: 10000
X-RateLimit-Remaining: 9847
X-RateLimit-Reset: 1732580400

• X-RateLimit-Limit - Maximum requests in current window
• X-RateLimit-Remaining - Requests remaining
• X-RateLimit-Reset - Unix timestamp when limit resets

Authentication Errors

401 Unauthorized - Missing API Key

{
  "type": "/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key required. Include your key in the X-API-Key header."
}

401 Unauthorized - Invalid API Key

{
  "type": "/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid API key. Check your key or generate a new one at marsvista.dev"
}

429 Too Many Requests - Rate Limited

{
  "type": "/errors/rate-limit-exceeded",
  "title": "Rate Limit Exceeded",
  "status": 429,
  "detail": "You have exceeded the hourly rate limit of 10000 requests.",
  "retryAfter": 1523
}

The retryAfter field indicates seconds until you can make requests again.

Security Best Practices

• ✓Store keys in environment variables, never in source code
• ✓Use server-side requests - never expose your API key in client-side JavaScript
• ✓Regenerate if compromised - if your key is exposed, regenerate immediately
• ✗Never commit API keys to git repositories
• ✗Never share your key - each user should have their own key