Credentials

Weather observations, climate, and the default training-table path call public endpoints without an account. Credentials unlock specific licensed, deeper-history, or hosted paths; they do not change the name of the source that produced a row.

from mostlyright import weather

table = weather.training_table(
    "KNYC",
    "2025-01-06",
    "2025-01-12",
)

No key is required for that call.

Environment-variable matrix

Variable	Used for	Without it
FRED_API_KEY	ALFRED first-print economic vintages and deeper FRED-backed history	Latest-revised agency fallbacks may remain available, but first-print reads can raise with this key named as the fix
BEA_API_KEY	BEA GDP fallback	GDP paths that require BEA raise a typed source-availability error
BLS_API_KEY	Higher BLS request limits	Unkeyed BLS limits apply
EUMETSAT_CONSUMER_KEY + EUMETSAT_CONSUMER_SECRET	Meteosat satellite objects	Meteosat raises a typed error; other satellite families are unaffected
MOSTLYRIGHT_WEATHER_HOSTED_URL + MOSTLYRIGHT_API_KEY	Hosted weather serving, including hosted satellite delivery	Local weather reads remain the default; hosted calls fail configuration checks
MOSTLYRIGHT_FINANCE_HOSTED_URL + MOSTLYRIGHT_API_KEY	Hosted earnings transcript REST/stream	Local finance paths remain separate
MOSTLYRIGHT_ECONOMY_HOSTED_URL + MOSTLYRIGHT_API_KEY	Reserved hosted economy transport	delivery="hosted" is unavailable until that transport lands
MOSTLYRIGHT_CACHE_DIR	Relocate the local cache	Defaults to ~/.mostlyright/cache/
MOSTLYRIGHT_CWOP_DIR	Relocate CWOP registry/capture state	Uses the default CWOP location

The 2.0 hosted names are fully namespaced. WEATHER_HOSTED_URL, EARNINGS_HOSTED_URL, and MOSTLYRIGHT_CWOP_HOME are old names and are not the current configuration contract.

Set secrets outside code

export FRED_API_KEY="..."
export MOSTLYRIGHT_WEATHER_HOSTED_URL="https://weather.example"
export MOSTLYRIGHT_API_KEY="..."

Use a shell profile for local development and your platform’s secret manager in production. Do not commit .env files containing real keys.

Failure behavior

• Missing credentials fail loudly with the exact variable named.
• Invalid source/delivery values fail before network I/O.
• Credentials change access, not provenance. A keyed ALFRED row is still identified as its actual source.
• Hosted calls require both the service URL and MOSTLYRIGHT_API_KEY.

Hosted browser clients

The TypeScript hosted helpers accept explicit configuration because browsers do not have a safe, general-purpose process environment:

import { satelliteHosted } from "@mostlyrightmd/weather/hosted";

const result = await satelliteHosted({
  hostedUrl,
  apiKey,
  station: "KNYC",
  fromTime: "2025-01-06T00:00:00Z",
  toTime: "2025-01-07T00:00:00Z",
  satellite: "goes16",
});

Do not ship a durable shared API key in a public web bundle. Put credentialed calls behind your backend or mint a short-lived scoped token.

See also

• Economy: first-print and fallback behavior
• Cache: local cache paths
• Browser integration: CORS and client-side secret handling
• Packages & versioning: install matrix