What we shipped this month: geocoding, IP, time zone and more
A roundup of recent work across the API: new compatibility hosts, faster time zone and elevation lookups, dashboard features, and clearer quota visibility.
Two-factor authentication for your account
An API key sitting in a dashboard is worth protecting, and the account that manages it deserves more than a password alone. Two-factor authentication is now available on every My Geocode account, ready to turn on from the dashboard settings.
Once enabled, logging into the client dashboard requires a second step beyond your password, tying account access to a device you control rather than to a password alone. This is entirely separate from how API keys authenticate against the API itself: a key still works as an X-API-Key header, an Authorization: Bearer header, HTTP Basic auth, or a query parameter, exactly as it always has. Two-factor authentication protects the account that manages those keys, not the request traffic those keys send.
We built this as an opt-in feature rather than a requirement, because accounts vary in what they need. A personal project with a single low-volume key has different risk than an account managing Unlimited packages and a team's worth of production keys. Either way, turning it on takes a few minutes inside the dashboard, and turning it off again is just as straightforward if your workflow changes.
This sits alongside the rest of the account and security surface already in the dashboard: usage stats, invoices, API keys, a referral program, and language and dark-mode settings, all reachable from /dashboard. Two-factor authentication is one more setting in that same place, not a separate system to learn.
For anyone managing an Unlimited package or meaningful prepaid credit, we would recommend turning this on sooner rather than later. Account access effectively controls billing and key management both, so a second factor there is a small step that closes a real gap. It is also a good moment to review the API keys listed at /dashboard/keys and remove any that are no longer in active use, since fewer live keys means less that needs protecting in the first place.
Two-factor authentication does not change anything about how the API responds to requests, how quota headers work, or how billing is calculated. It changes exactly one thing: who can get into the account that manages all of that. For most accounts, that is worth the extra step at login.