If you publish a map, you are also exposing your map key. MapTiler offers several methods to give you control over the key to avoid misuse. Your key setting can be found if you log in to MapTiler Cloud → Account→API Keys→Edit (on the preferred key).
Allow map usage only on listed websites
If you have your map published only on certain websites, you can list them in the Allowed HTTP origins field. For example, mydomain.com will ensure, that only requests coming from mydomain.com will be processed. Use *.mydomain.com to allow requests from subdomains.
Put each rule on a separate line. Make sure your applications send the Origin (or Referer) header, otherwise the requests will be treated as "unknown" and will be rejected if any origin is specified here.
You can use ? placeholder to explicitly allow unknown origins (requests with Origin header coming from a domain that is not in this list will still be rejected).
Allow map usage only by listed software
For other usages where the map is not used on a specific URL, like mobile apps or desktop GIS software, you can whitelist only software with a specific user agent to be able to use your map.
In the Allowed user-agent header field, fill in a (case-sensitive) substring of your software's user-agent. The saved substring will be compared with the User-Agent HTTP header of each request and if it will be found there, the request will proceed, otherwise, it will be denied.
Note: only a substring is being compared with the User-Agent HTTP header. If you save a "coolest-mobile-map-app" there, it will work fine with "coolest-mobile-map-app-0.5", "coolest-mobile-map-app-1.1" etc. But it will also work with "my-friends-coolest-mobile-map-app".
Comments
1 comment
thanks for this.. but where is the "Allowed user-agent header field" ? Is there some place in my maptiler account where I can set this?
Thanks!
Please sign in to leave a comment.