Authentication

Authenticate requests using the x-api-key HTTP header.

API Keys

Obtain your API key from the Dashboard. Include it in every request via the x-api-key header.

Keep your API key secure. Do not expose it in client-side code, public repositories, or browser developer tools.

Request Format

Include the x-api-key header on every request:

HTTP Request

GET /ingredients/search?q=mango HTTP/1.1
Host: developer-portal-backend-694046361762.northamerica-northeast1.run.app
x-api-key: YOUR_API_KEY
Accept: application/json

GET /ingredients/search?q=mango HTTP/1.1
Host: developer-portal-backend-694046361762.northamerica-northeast1.run.app
x-api-key: YOUR_API_KEY
Accept: application/json

cURL

curl "https://developer-portal-backend-694046361762.northamerica-northeast1.run.app/ingredients/search?q=mango" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Accept: application/json"

curl "https://developer-portal-backend-694046361762.northamerica-northeast1.run.app/ingredients/search?q=mango" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Accept: application/json"

Environment Variables

Store your API key in an environment variable rather than hardcoding:

.env

# .env file (never commit this!)
JOURNEYFOODS_API_KEY=YOUR_API_KEY

app.js

// Using environment variables (recommended)
const response = await fetch(
  'https://developer-portal-backend-694046361762.northamerica-northeast1.run.app/ingredients/search?q=mango',
  {
    headers: {
      'x-api-key': process.env.JOURNEYFOODS_API_KEY,
      'Accept': 'application/json'
    }
  }
);

// Using environment variables (recommended)
const response = await fetch(
  'https://developer-portal-backend-694046361762.northamerica-northeast1.run.app/ingredients/search?q=mango',
  {
    headers: {
      'x-api-key': process.env.JOURNEYFOODS_API_KEY,
      'Accept': 'application/json'
    }
  }
);

Response Codes

Standard response codes for all endpoints:

Status	Description
200 OK	Request succeeded
401 Auth Error	Invalid or missing API key
429 Limited	Rate limit exceeded

Security Best Practices

Keep your API keys secure

Never expose API keys in client-side code, public repositories, or browser developer tools. Make API calls from your backend server.

Recommended practices:

Store API keys in environment variables or a secure secrets manager
Use different API keys for development and production
Rotate keys periodically
Monitor usage in your dashboard for unusual activity
Revoke and regenerate keys immediately if compromised

Plan-Based Access

Response fields are gated by plan. Basic, Pro, and Custom tiers have access to different field sets. Upgrade your plan to unlock additional data.

Plan	Access
Basic	Core ingredient and nutrient data
Pro	Extended fields, allergen details, product data
Custom	Full access, custom integrations, dedicated support