Authentication

The API uses personal access tokens (PATs) — a long-lived bearer token you create on the web and paste into your client. The same token works for the OpenCPN plugin, a curl script, or your own code.

Create a token

Go to Account → API tokens.
Click Create token, give it a descriptive name, and copy the wf_pat_… value. It is shown once — store it like a password.

Use a token

Send it as a Bearer token on every request:

curl -H "Authorization: Bearer wf_pat_…" \
  https://api.weatherfiles.com/v1/auth/me

/v1/auth/me echoes your tier, daily download limit, how many downloads you've used today, and which models you're allowed to access.

Revoke a token

Delete it from Account → API tokens — any client using it stops working immediately. Revoke the moment you suspect a leak.

Good hygiene

Never commit tokens to git — use an env var (WF_TOKEN) or your OS keystore.
One token per machine / integration, so a leak is contained and revocation is surgical.
v1 tokens are full-access on your own account (read + create/delete slices + download). Scoped / read-only tokens are planned for a later version.

Next: API reference — try any endpoint live with your token.