Overview

note

For all product information and purchases, please consult the meteoblue Weather API product page.
The following pages here contain all technical information about the meteoblue Weather APIs.

meteoblue provides APIs for on-demand access to weather, climate, observation, map, and visualisation data through HTTP-based interfaces. The APIs can be integrated into automated systems, websites, applications, dashboards, and analytical workflows, enabling customers to retrieve data or ready-to-use visualisations in different formats depending on the selected API and use case.

Weather data can be requested for specific locations using latitude and longitude coordinates, and selected APIs also support additional access patterns such as stations, map tiles, inventories, images, or predefined data packages. Forecast data is continuously updated using meteoblue Learning MultiModel approach, which combines multiple weather models, machine-learning methods, and short-term corrections from observations, radar, and satellite data where applicable.

meteoblue offers different types of Weather API products:

Product	Product Description	Technical Documentation	Product Page
Forecast API	Data packages as CSV or JSON for weather forecast data	Forecast API	Forecast API
History API	Single variable data as CSV or JSON for historical weather data	History API	History API
Image API	Charts as PNG images like meteograms, pictoprints or cross sections	Image API	Image API
Maps API	Weather maps, satellite and radar images	Maps API	Maps API
Dataset API	Access to whole meteoblue weather data archive	Dataset API	Dataset API
Further APIs	Location Search API and Domains API	Further APIs

API Access

To access the meteoblue Weather APIs you need to get an API key. Please contact [email protected] to apply for an free API key trial. We offer demand-based or flat-rate pricing.

The API key must be appended to all API calls. The example API URL above uses &apikey=DEMOKEY. An API key should be kept private to prevent misuse. The meteoblue API also offers signature mechanisms to protect the API key in dynamic web applications or mobile apps.

An API key is typically limited to the number of calls per day for individual data package, image or weather map. Without further agreement, we impose a rate limit of 500 calls per minute.

API Key Protection

Recommendations for API Key Protection:

For Native Mobile Apps

If calls are done in the frontend:

Sign your API calls using a shared secret
Obfuscate your code
Consider moving your API calls to a backend application (if feasible)

If calls are done in the backend:

See For Backend Applications section below.

For Websites or Mobile Apps Using Webviews

If calls are done in the frontend:

Sign your API calls using a shared secret
Use Origin/Referrer protection
Consider moving your API calls to a backend application (if feasible)

If calls are done in the backend:

See For Backend Applications section below.

For Backend Applications

Use IP protection
If your backend has a public-facing API that receives queries from a mobile app or website, consider limiting access to your backend to authenticated users only.

Signing API Calls with a Shared Secret

API calls are only authorized by API keys. To prevent unauthorized access, we offer a signature mechanism with a shared secret. On request we will associate a shared secret with your API key and enforce the signature security policy.

$sharedSecret = "MySharedSecret";
$query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

$sig = hash_hmac("sha256", $query, $sharedSecret);
$signedUrl = "https://my.meteoblue.com" . $query . "&sig=" . $sig;
// Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

const sharedSecret = "MySharedSecret";
const query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

const sig = require('crypto').createHmac('sha256', sharedSecret).update(query).digest('hex');
const signedUrl = `https://my.meteoblue.com${query}&sig=${sig}`;
// Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

using System;
using System.Security.Cryptography;
using System.Text;

class Program
{
    static void Main()
    {
        string sharedSecret = "MySharedSecret";
        string query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

        using (HMACSHA256 hmac = new HMACSHA256(Encoding.UTF8.GetBytes(sharedSecret)))
        {
            byte[] data = Encoding.UTF8.GetBytes(query);
            byte[] sigBytes = hmac.ComputeHash(data);
            string sig = BitConverter.ToString(sigBytes).Replace("-", "").ToLower();
            string signedUrl = $"https://my.meteoblue.com{query}&sig={sig}";
            // Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856
        }
    }
}

import hashlib
import hmac

sharedSecret = "MySharedSecret"
query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800"

sig = hmac.new(sharedSecret.encode(), query.encode(), hashlib.sha256).hexdigest()

signedUrl = f"https://my.meteoblue.com{query}&sig={sig}"
# Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import java.io.UnsupportedEncodingException;

public class Main {
    public static void main(String[] args) {
        String sharedSecret = "MySharedSecret";
        String query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

        try {
            Mac sha256Hmac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKey = new SecretKeySpec(sharedSecret.getBytes("UTF-8"), "HmacSHA256");
            sha256Hmac.init(secretKey);

            byte[] hmacBytes = sha256Hmac.doFinal(query.getBytes("UTF-8"));
            String sig = Base64.getEncoder().encodeToString(hmacBytes);

            String signedUrl = "https://my.meteoblue.com" + query + "&sig=" + sig;
            // Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856
        } catch (NoSuchAlgorithmException | UnsupportedEncodingException e) {
            e.printStackTrace();
        }
    }
}

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
)

func main() {
    sharedSecret := "MySharedSecret"
    query := "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800"

    h := hmac.New(sha256.New, []byte(sharedSecret))
    h.Write([]byte(query))
    sig := hex.EncodeToString(h.Sum(nil))

    signedUrl := fmt.Sprintf("https://my.meteoblue.com%s&sig=%s", query, sig)
    // Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856
}

require 'openssl'

sharedSecret = 'MySharedSecret'
query = '/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800'

digest = OpenSSL::Digest.new('sha256')
hmac = OpenSSL::HMAC.hexdigest(digest, shared_secret, query)

signedUrl = "https://my.meteoblue.com#{query}&sig=#{hmac}"
# Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

A maximum expiration time (&expire=1924948800, standing for 2030-12-31 12:00pm) can be specified to limit the validity of a call to a fixed unix timestamp. If it is not specified, the API query can be repeated indefinitely, but any modification to the URL will break the signature.

If UTF-8 characters are present in URL parameters, it is necessary to encode them before calculating the SHA256 HMAC signature. In PHP this can be done using the function urlencode().

$query = "/packages/basic-1h?lat=52.41&lon=16.93&city=" . urlencode("Poznań");
// Result /packages/basic-1h?lat=52.41&lon=16.93&city=Pozna%C5%84

This feature is intended to integrate meteoblue APIs directly into web-interfaces. We recommend a 10 minutes expire time. For more dynamic applications like mobile apps we recommend, that users are authorized on your systems and then signed URLs to the meteoblue APIs are returned.

Referrer and Origin Protection

You can define a referrer and origin allow list to protect your API key. One wildcard at the start of the domain is supported. You also can specify several domains separated by comma (,) with no space.

Examples:

- www.meteoblue.com
- *.meteoblue.com
- www.meteoblue.com,www.google.com

IP Protection

You can define an IP address range allow list to protect your API key. The supported formats are IPv4 and IPv6 as well as CIDR-Notation for IP ranges. You can also specify several IPs separated by comma (,) with no space.

Examples:

- 192.0.2.1
- 2001:db8:0:1234:0:567:8:1
- 192.0.2.1,192.0.2.2
- 192.0.2.1/12

API Access​

API Key Protection​

Recommendations for API Key Protection:​

For Native Mobile Apps​

For Websites or Mobile Apps Using Webviews​

For Backend Applications​

Signing API Calls with a Shared Secret​

Referrer and Origin Protection​

IP Protection​