Overview
Council DA API uses API keys for authentication. Every request must include your API key in the X-API-Key header.
curl -X GET "https://api.councilapi.com.au/v1/applications" \
-H "X-API-Key: cda_str_abc123xyz789..."Getting Your API Key
API Key Format
API keys follow a specific format that indicates the plan tier:
| Prefix | Plan | Example |
|---|---|---|
cda_str_ | Starter | cda_str_abc123... |
cda_pro_ | Pro | cda_pro_def456... |
cda_bus_ | Business | cda_bus_ghi789... |
Security Best Practices
✓
Use environment variables
Store your API key in environment variables, not in code.
# .env file
COUNCIL_API_KEY=cda_str_abc123...
# Python
import os
api_key = os.environ.get("COUNCIL_API_KEY")✓
Never commit keys to git
Add .env to your .gitignore file.
✓
Use separate keys for environments
Create different API keys for development, staging, and production.
✓
Rotate keys periodically
Regenerate your API keys periodically and if you suspect they've been compromised.
✓
Enable IP whitelisting (Business)
Business plans can restrict API key usage to specific IP addresses.
Authentication Errors
| Status | Error | Cause |
|---|---|---|
401 | Missing API Key | No X-API-Key header provided |
401 | Invalid API Key | Key doesn't exist or has been revoked |
403 | IP Not Allowed | Request IP not in whitelist (Business) |
403 | Key Expired | API key has passed its expiration date |