Use your api.data.gov key with every federal API.

Register once at api.data.gov/signup and that one key unlocks FEC, NASA, NPS, FDA, USDA, and Census endpoints. The email you provide is just for rate-limit accounting — there is no approval step and the key arrives instantly. USAJOBS, FRED, BLS, and EIA each require their own free key (see each agency’s developer page).

Treat the key like a password: do not commit it to source control. In this project, store it under DATA_GOV_API_KEY in Cloud → Secrets so server functions can read it from process.env.

Most api.data.gov-fronted endpoints accept the key as the api_key query parameter. A few (NPS, some NOAA endpoints) prefer it as an X-Api-Key header. Both work identically for rate-limit accounting.

curl -G 'https://api.open.fec.gov/v1/candidates/' \
  -d api_key=$DATA_GOV_API_KEY \
  -d q=harris \
  -d sort=name

curl 'https://developer.nps.gov/api/v1/parks?stateCode=CA' \
  -H "X-Api-Key: $DATA_GOV_API_KEY"

api.data.gov returns X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset on every response. Default quota is 1,000 requests/hour per key. A 429 response means you’ve hit the cap; back off until the reset timestamp.

const res = await fetch(url)
const limit = res.headers.get('x-ratelimit-limit')
const remaining = res.headers.get('x-ratelimit-remaining')
const reset = res.headers.get('x-ratelimit-reset')
if (res.status === 429) throw new Error(`Rate limited; resets at ${reset}`)

Pass UI state directly into query parameters and keep the request function pure.

curl -G 'https://api.open.fec.gov/v1/schedules/schedule_a/' \
  -d api_key=$DATA_GOV_API_KEY \
  -d contributor_state=CA \
  -d min_amount=2500 \
  -d sort=-contribution_receipt_amount \
  -d per_page=100 -d page=1

Paginate, normalize, then convert to a CSV blob in the browser. Stable column keys keep the export aligned with what users see on screen.

const csv = [headers.join(','), ...rows.map(r => headers.map(h => esc(r[h])).join(','))].join('\n')
const url = URL.createObjectURL(new Blob([csv], { type: 'text/csv' }))

USAJOBS needs a User-Agent header plus an Authorization-Key header. FRED takes api_key as a query param. BLS is technically open but works more reliably with a key. Build a tiny auth adapter rather than assuming one universal rule.

SEC EDGAR and NWS both require a descriptive User-Agent identifying your app and contact email — requests without it are rejected.