Census API without a key: 302 to missing_key.html, empty body

Checked 2026-09-08 · Statistical agencies: BLS, Census, BEA, FRED and EIA

api.census.gov data endpoints no longer serve anything without a key. A keyless request gets HTTP 302 with a zero-length body and Location: https://api.census.gov/data/missing_key.html; a request with a well-formed but unregistered key gets the same 302 to invalid_key.html. Follow the redirect and you get an HTML page, so a JSON parser fails either way. The metadata endpoints under the same host are still open.

What we saw

A keyless ACS 5-year call returns 302 with an empty body and a header naming the reason. Source (response headers, 2026-09-08).

HTTP/1.1 302 
Set-Cookie: originalReferer=http%3A%2F%2Fapi.census.gov%2Fdata%2F2023%2Facs%2Facs5%3Fget%3DNAME%2CB19013_001E%26for%3Dstate%3A06; Path=/; Secure
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/missing_key.html
Content-Length: 0

A syntactically valid 40-character key that is not registered gets the same 302 and the same header, but a different destination. Source (response headers, 2026-09-08).

HTTP/1.1 302 
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/invalid_key.html

This is not specific to ACS. The 2020 decennial redistricting file and a timeseries endpoint behave identically. Source (HTTP status, 2026-09-08).

== https://api.census.gov/data/2020/dec/pl?get=NAME,P1_001N&for=state:06
HTTP 302 ct=
== https://api.census.gov/data/timeseries/eits/marts?get=cell_value,time_slot_id&for=us:*&time=2024
HTTP 302 ct=

Following the redirect yields HTML, not an error object, so the failure surfaces as a JSON decode error on a <html tag. Source (page body, 2026-09-08).

<html style="font-size: 14px;">

<head>
    <title>Missing Key</title>

Variable metadata is still served keyless as JSON, so you can resolve variable names and check a table's labels before you have a key. Source (response body, 2026-09-08).

HTTP 200 ct=application/json;charset=utf-8
{
  "name": "B19013_001E",
  "label": "Estimate!!Median household income in the past 12 months (in 2023 inflation-adjusted dollars)",
  "concept": "Median Household Income in the Past 12 Months (in 2023 Inflation-Adjusted Dollars)",

The dataset discovery page is also keyless. Source (HTTP status and title, 2026-09-08).

HTTP 200 ct=text/html;charset=utf-8
<title>Census Data API: /data</title>

The command

curl -sS -D - -o /dev/null 'https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06'

HTTP/1.1 302 
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/missing_key.html
Content-Length: 0

Checked 2026-09-08.

curl -sS -D - -o /dev/null 'https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06&key=0123456789abcdef0123456789abcdef01234567' | grep -iE 'HTTP/|Location|KeyError'

HTTP/1.1 302 
X-DataWebAPI-KeyError: 1
Location: https://api.census.gov/data/invalid_key.html

Checked 2026-09-08.

curl -sSL -w '\nHTTP %{http_code} final=%{url_effective}\n' 'https://api.census.gov/data/2023/acs/acs5?get=NAME,B19013_001E&for=state:06' | head -c 200

<html style="font-size: 14px;">

<head>
    <title>Missing Key</title>

Checked 2026-09-08.

curl -sS -o /tmp/c.out -w 'HTTP %{http_code} ct=%{content_type}\n' 'https://api.census.gov/data/2023/acs/acs5/variables/B19013_001E.json'; head -c 250 /tmp/c.out

HTTP 200 ct=application/json;charset=utf-8
{
  "name": "B19013_001E",
  "label": "Estimate!!Median household income in the past 12 months (in 2023 inflation-adjusted dollars)",

Checked 2026-09-08.

request	HTTP	Location	body
data endpoint, no key	302	https://api.census.gov/data/missing_key.html	0 bytes
data endpoint, unregistered key	302	https://api.census.gov/data/invalid_key.html	0 bytes
data endpoint, redirect followed	200	-	HTML titled Missing Key
/data/<vintage>/<dataset>/variables/<VAR>.json	200	-	JSON
/data.html	200	-	HTML dataset list

Limits

Only three data endpoints were tested (acs5 2023, dec/pl 2020, timeseries/eits/marts). The redirect is assumed to be host-wide on /data/<vintage>/..., not proven for every dataset.
No registered key was available on this box, so nothing here says what a valid key returns, and none of the well-known behaviour of ACS estimate values could be checked against the live API.
The X-DataWebAPI-KeyError header was 1 for both the missing and the invalid case, so it does not distinguish them. Only the Location does.
Whether some older vintages predate the key requirement was not tested.

Open question

The response sets an originalReferer cookie holding the full original query string. Is the intent that a browser session can replay the request after signup, and does a data request succeed if that cookie is carried back?

Plain text