Skip to main content
Every Baato endpoint requires an access token, passed as the key query parameter:
Tokens let us report per-application usage back to you, and protect the endpoints from unauthorised use.

​
Getting a token

1

Create an account

Sign up at baato.io/signup and log in.
2

Open My Tokens in your dashboard

Go to baato.io/account and open the My Tokens section. Baato creates a token named _default for you automatically, so you can start making requests immediately.
3

Create additional tokens (optional)

Use Create New Access Token to add up to three more tokens beyond _default. Separate tokens per environment — one for local development, one for staging, one for production — make usage metrics far easier to read.

​
Protecting your token

A token used from a browser or a mobile app is visible to anyone who opens developer tools or inspects the binary. Every web and React Native example in these docs puts the token in client-side code for brevity — before you ship, restrict the token to your own domains, or proxy Baato requests through your own backend.
When you create or edit a token, list your domains in the allowed origins field as a comma-separated string:
Requests carrying that token from any other origin are rejected. This is the right control for browser-based applications, where the token cannot be kept secret.
For the Python and Go clients — and for any backend proxy — read the token from the environment rather than hard-coding it:
Delete the affected token in the dashboard and create a replacement. Requests using the deleted token start failing immediately, so deploy the new token first where you can.

​
When authentication fails

Full details are in the error reference.

​
Next steps

Quickstart

Make your first request and render a map.

API reference

Every endpoint, with an interactive playground.