Skip to content
Mostly Right

Guides

Credentials

The default paths need no account and no API key: the SDK calls public endpoints from your runtime. A short list of sources wants a key for depth or licensing reasons. All of them are read from environment variables, never from code. 

# The common case: nothing. This page exists for the exceptions.
from mostlyright import weather
weather.pairs("KNYC", "2025-01-06", "2025-01-12").shape   # no key involved

The matrix

Section titled “The matrix”
Env varUnlocksWithout it
FRED_API_KEYSettlement-grade ALFRED vintage queries at depth (econ)Core econ indicator paths still work keyless
BEA_API_KEYLatest-revised GDP from BEA (econ)First-print GDP paths unaffected
BLS_API_KEYHigher BLS rate limits (econ)Optional; polite unkeyed limits apply
EUMETSAT_CONSUMER_KEY + EUMETSAT_CONSUMER_SECRETMeteosat satellite covariates (weather)GOES paths unaffected; Meteosat raises a typed error naming these vars
MOSTLYRIGHT_API_KEY + WEATHER_HOSTED_URLThe opt-in hosted satellite transport (delivery="hosted")Local-first satellite fetch remains the default

Non-secret configuration lives beside them: MOSTLYRIGHT_CACHE_DIR relocates the cache root (see Cache).

Conventions

Section titled “Conventions”
  • Environment only. No credential is ever passed as a function argument or written into a notebook. Set them in your shell profile, your service’s secret store, or a local .env your runner loads.
  • Fail loud and named. A path that needs a missing key raises a typed error naming the exact variable; nothing silently degrades to a different source.
  • Provenance is unchanged. A keyed fetch tags rows with the same source identity as an unkeyed one; keys change access, never data shape.
Terminal window
# ~/.zshrc or your secret manager of choice
export FRED_API_KEY="..."
export BEA_API_KEY="..."

The hosted transport is opt-in

Section titled “The hosted transport is opt-in”

delivery="hosted" on satellite surfaces routes the fetch through a deployed precompute service (${WEATHER_HOSTED_URL}/satellite, authenticated with MOSTLYRIGHT_API_KEY) instead of your runtime pulling GOES objects directly. It exists for fleet-scale satellite workloads; local-first stays the stated default everywhere, and no other surface requires it.

See also

Section titled “See also”