Credentials

A Mostly Right API key downloads the current source manifest. The manifest supplies the endpoints, schemas, and source metadata used by the SDK. The SDK then fetches data directly from each source.

Get a key

The key comes with the subscription (USD 29/month). Create an account at app.mostlyright.md, subscribe, issue a key, and store it as an environment variable:

export MOSTLYRIGHT_API_KEY="..."

The key authenticates the manifest request. It is not sent to public weather, market, economy, or finance sources.

What the key controls

The SDK requests the current manifest with MOSTLYRIGHT_API_KEY.
The manifest returns the current endpoint, schema, and source definitions.
The SDK requests rows directly from the selected source.

The manifest is not bundled into the packages. This keeps source changes out of package releases while preserving direct source access. Missing or invalid keys raise ApiKeyRequiredError before the SDK calls a source. See the hosted manifest guide for lapse behavior.

Environment-variable matrix

Variable	Used for	Without it
`MOSTLYRIGHT_API_KEY`	Required access to the current Mostly Right source manifest	The SDK cannot resolve source endpoints or schemas and stops before fetching data
`FRED_API_KEY`	ALFRED first-print economic vintages and deeper FRED-backed history	Latest-revised agency fallbacks may remain available, but first-print reads can raise with this key named as the fix
`BEA_API_KEY`	BEA GDP fallback	GDP paths that require BEA raise a typed source-availability error
`BLS_API_KEY`	Higher BLS request limits	Unkeyed BLS limits apply
`EUMETSAT_CONSUMER_KEY` + `EUMETSAT_CONSUMER_SECRET`	Meteosat satellite objects	Meteosat raises a typed error; other satellite families are unaffected
`MOSTLYRIGHT_WEATHER_HOSTED_URL`	Optional hosted weather delivery, including satellite delivery	The SDK fetches supported weather data directly from its source
`MOSTLYRIGHT_FINANCE_HOSTED_URL`	Optional hosted earnings transcript REST/stream	Local finance paths remain separate
`MOSTLYRIGHT_ECONOMY_HOSTED_URL`	Reserved hosted economy transport	`delivery="hosted"` is unavailable until that transport lands
`MOSTLYRIGHT_CACHE_DIR`	Relocate the local cache	Defaults to `~/.mostlyright/cache/`
`MOSTLYRIGHT_CWOP_DIR`	Relocate CWOP registry/capture state	Uses the default CWOP location

The hosted names are fully namespaced. WEATHER_HOSTED_URL, EARNINGS_HOSTED_URL, and MOSTLYRIGHT_CWOP_HOME are old names and are not the current configuration contract.

Set secrets outside code

export FRED_API_KEY="..."
export MOSTLYRIGHT_WEATHER_HOSTED_URL="https://weather.example"
export MOSTLYRIGHT_API_KEY="..."

Use a shell profile for local development and your platform’s secret manager in production. Do not commit .env files containing real keys.

Failure behavior

A missing or invalid MOSTLYRIGHT_API_KEY stops manifest resolution before a source request.
Missing source credentials fail loudly with the exact variable named.
Invalid source/delivery values fail before network I/O.
Credentials change access, not provenance. A row still identifies the source that returned it.
Hosted calls require both the service URL and MOSTLYRIGHT_API_KEY.

Hosted browser clients

The TypeScript hosted helpers accept explicit configuration because browsers do not have a safe, general-purpose process environment:

import { satelliteHosted } from "@mostlyrightmd/weather/hosted";

const result = await satelliteHosted({
  hostedUrl,
  apiKey,
  station: "KNYC",
  fromTime: "2025-01-06T00:00:00Z",
  toTime: "2025-01-07T00:00:00Z",
  satellite: "goes16",
});

Do not ship a durable shared API key in a public web bundle. Put credentialed calls behind your backend or mint a short-lived scoped token.