meteoblue Weather API vs Meteomatics Weather API

meteoblue Weather API

Eight of the APIs publish OpenAPI 3.1 specs, and the Forecast API spec lists the credit cost of every package. A public Pingdom page shows monthly uptime per API. The key travels only in the query string, the free trial covers nine forecast packages, and no security.txt, certification or DPA was found.

Meteomatics Weather API

A public OpenAPI file, a hosted MCP server whose nine tools are all marked read-only, a published SLA with compensation and ISO 27001 certification suit company use. Access needs a sales contract, with no public price, free tier or self-serve signup found, no status page, and REST calls that authenticate with a username and password.

meteoblue Weather API

1. Pass lat, lon and apikey to https://my.meteoblue.com/packages/<package>. Join packages with commas, such as basic-1h,basic-day, to get several in one call
2. Budget credits before calling. One call costs 4,000 to 96,000 credits by package, and the free trial holds 10 million for a year. Read MB-Credits-Accounted on each response
3. Set forecastDays and pick the coarsest resolution that does the job. Without it the API returns every forecast day it has
4. Call with a 30-second timeout, wait 30 seconds after an error and stop after 10 retries, as the availability page advises. The default limit is 500 calls a minute
5. Keep the key out of logs, since it is part of every URL. Ask for a shared secret and send expire and sig if URLs may be seen by others

Meteomatics Weather API

1. Ask the account owner for credentials first. There is no signup, and both the REST API and the MCP server need a Meteomatics account with API access
2. Build REST URLs as validdatetime/parameters/location/format, for example 2026-10-08T00:00:00Z/t_2m:C/52.52,13.40/json. Parameter names carry their unit after a colon
3. Keep each query to 10 locations and 10 parameters unless the contract says otherwise, and use POST when a GET URL passes 2,000 characters
4. Send credentials or the token in the Authorization header. Avoid the documented access_token query parameter, which puts the token in URLs and logs
5. Read /user_stats_json before a large job. It reports queries sent and the contract's limits, and 429 means a limit is spent
6. Treat reserved values such as -888 and -999 as invalid or missing data, and shrink the request when a 408 arrives after the 300-second timeout