Overview

note

For all product information and purchases, please consult the meteoblue Weather API product page.
The following pages here contain all technical information about the meteoblue Weather APIs.

meteoblue provides APIs for on-demand access to weather, climate, observation, map, and visualisation data through HTTP-based interfaces. The APIs can be integrated into automated systems, websites, applications, dashboards, and analytical workflows, enabling customers to retrieve data or ready-to-use visualisations in different formats depending on the selected API and use case.

Weather data can be requested for specific locations using latitude and longitude coordinates, and selected APIs also support additional access patterns such as stations, map tiles, inventories, images, or predefined data packages. Forecast data is continuously updated using meteoblue Learning MultiModel approach, which combines multiple weather models, machine-learning methods, and short-term corrections from observations, radar, and satellite data where applicable.

meteoblue offers different types of Weather API products:

Product	Product Description	Technical Documentation	Product Page
Forecast API	Location-specific weather forecast data through structured data packages, available in formats such as JSON, CSV, XLSX, Highcharts, and Highcharts HTML. Supports general weather, sector-specific packages, probabilistic data, nowcasting, and raw or multimodel forecast workflows.	Forecast API	Forecast API
Measurements API	Ground-based weather observations from measurement stations and data providers. Supports access to station metadata, source discovery, and recent or historical observations for stations or geographic areas.	Measurements API	Measurements API
History API	Historical weather data for selected variables and locations, based mainly on ERA5T reanalysis with gap filling from meteoblue model data where needed.	History API	History API
Image API	Ready-to-use weather and climate visualisations generated through API calls, including forecast images and history/climate charts.	Image API	Image API
Maps API	Weather map and tile services for visualising forecast, radar, satellite, and model data through map layers, plugins, inventory configuration, and tile endpoints.	Maps API	Maps API
Dataset API	Access to large meteoblue weather datasets and archives for bulk or custom data delivery workflows.	Dataset API	Dataset API
Warnings API	Official weather warnings for selected coordinates, including warning text, classification information, affected areas, and metadata in CAP format where available. Suitable for alerting systems, mobile applications, dashboards, and operational weather-risk workflows.	Warnings API	Warnings API
Further APIs	Supporting APIs such as Location Search, Account, Domains and Crop Risk.	Further APIs

API Access

To access the meteoblue Weather APIs you need to get an API key. Please contact [email protected] to apply for an free API key trial. We offer demand-based or flat-rate pricing.

The API key must be appended to all API calls. The example API URL above uses &apikey=DEMOKEY. An API key should be kept private to prevent misuse. The meteoblue API also offers signature mechanisms to protect the API key in dynamic web applications or mobile apps.

An API key is typically limited to the number of calls per day for individual data package, image or weather map. Without further agreement, we impose a rate limit of 500 calls per minute.

API Key Protection

Recommendations for API Key Protection:

For Native Mobile Apps

If calls are done in the frontend:

• Sign your API calls using a shared secret
• Obfuscate your code
• Consider moving your API calls to a backend application (if feasible)

If calls are done in the backend:

• See For Backend Applications section below.

For Websites or Mobile Apps Using Webviews

If calls are done in the frontend:

• Sign your API calls using a shared secret
• Use Origin/Referrer protection
• Consider moving your API calls to a backend application (if feasible)

If calls are done in the backend:

• See For Backend Applications section below.

For Backend Applications

• Use IP protection
• If your backend has a public-facing API that receives queries from a mobile app or website, consider limiting access to your backend to authenticated users only.

Signing API Calls with a Shared Secret

API calls are only authorized by API keys. To prevent unauthorized access, we offer a signature mechanism with a shared secret. On request we will associate a shared secret with your API key and enforce the signature security policy.

PHP

$sharedSecret = "MySharedSecret";
$query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

$sig = hash_hmac("sha256", $query, $sharedSecret);
$signedUrl = "https://my.meteoblue.com" . $query . "&sig=" . $sig;
// Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

JavaScript

const sharedSecret = "MySharedSecret";
const query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

const sig = require('crypto').createHmac('sha256', sharedSecret).update(query).digest('hex');
const signedUrl = `https://my.meteoblue.com${query}&sig=${sig}`;
// Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

C#

using System;
using System.Security.Cryptography;
using System.Text;

class Program
{
    static void Main()
    {
        string sharedSecret = "MySharedSecret";
        string query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

        using (HMACSHA256 hmac = new HMACSHA256(Encoding.UTF8.GetBytes(sharedSecret)))
        {
            byte[] data = Encoding.UTF8.GetBytes(query);
            byte[] sigBytes = hmac.ComputeHash(data);
            string sig = BitConverter.ToString(sigBytes).Replace("-", "").ToLower();
            string signedUrl = $"https://my.meteoblue.com{query}&sig={sig}";
            // Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856
        }
    }
}

Python

import hashlib
import hmac

sharedSecret = "MySharedSecret"
query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800"

sig = hmac.new(sharedSecret.encode(), query.encode(), hashlib.sha256).hexdigest()

signedUrl = f"https://my.meteoblue.com{query}&sig={sig}"
# Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

Java

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import java.io.UnsupportedEncodingException;

public class Main {
    public static void main(String[] args) {
        String sharedSecret = "MySharedSecret";
        String query = "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800";

        try {
            Mac sha256Hmac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKey = new SecretKeySpec(sharedSecret.getBytes("UTF-8"), "HmacSHA256");
            sha256Hmac.init(secretKey);

            byte[] hmacBytes = sha256Hmac.doFinal(query.getBytes("UTF-8"));
            String sig = Base64.getEncoder().encodeToString(hmacBytes);

            String signedUrl = "https://my.meteoblue.com" + query + "&sig=" + sig;
            // Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856
        } catch (NoSuchAlgorithmException | UnsupportedEncodingException e) {
            e.printStackTrace();
        }
    }
}

Go

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
)

func main() {
    sharedSecret := "MySharedSecret"
    query := "/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800"

    h := hmac.New(sha256.New, []byte(sharedSecret))
    h.Write([]byte(query))
    sig := hex.EncodeToString(h.Sum(nil))

    signedUrl := fmt.Sprintf("https://my.meteoblue.com%s&sig=%s", query, sig)
    // Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856
}

Ruby

require 'openssl'

sharedSecret = 'MySharedSecret'
query = '/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800'

digest = OpenSSL::Digest.new('sha256')
hmac = OpenSSL::HMAC.hexdigest(digest, shared_secret, query)

signedUrl = "https://my.meteoblue.com#{query}&sig=#{hmac}"
# Result: https://my.meteoblue.com/packages/basic-1h?lat=47.1&lon=8.6&apikey=DEMOKEY&expire=1924948800&sig=a1fe106e1a0d31b122305f569532d2f646ad722d7a90bed69971bb8ce4466856

A maximum expiration time (&expire=1924948800, standing for 2030-12-31 12:00pm) can be specified to limit the validity of a call to a fixed unix timestamp. If it is not specified, the API query can be repeated indefinitely, but any modification to the URL will break the signature.

If UTF-8 characters are present in URL parameters, it is necessary to encode them before calculating the SHA256 HMAC signature. In PHP this can be done using the function urlencode().

$query = "/packages/basic-1h?lat=52.41&lon=16.93&city=" . urlencode("Poznań");
// Result /packages/basic-1h?lat=52.41&lon=16.93&city=Pozna%C5%84

This feature is intended to integrate meteoblue APIs directly into web-interfaces. We recommend a 10 minutes expire time. For more dynamic applications like mobile apps we recommend, that users are authorized on your systems and then signed URLs to the meteoblue APIs are returned.

Referrer and Origin Protection

You can define a referrer and origin allow list to protect your API key. One wildcard at the start of the domain is supported. You also can specify several domains separated by comma (,) with no space.

Examples:

- www.meteoblue.com
- *.meteoblue.com
- www.meteoblue.com,www.google.com

IP Protection

You can define an IP address range allow list to protect your API key. The supported formats are IPv4 and IPv6 as well as CIDR-Notation for IP ranges. You can also specify several IPs separated by comma (,) with no space.

Examples:

- 192.0.2.1
- 2001:db8:0:1234:0:567:8:1
- 192.0.2.1,192.0.2.2
- 192.0.2.1/12