Create a free account on the target city's Socrata-hosted open-data portal (e.g. data.cityofnewyork.us, data.cityofchicago.org, data.sfgov.org)
Generate an application token from the account's developer settings
Attach the token using the X-App-Token HTTP header for SODA 2.x/3.0 endpoints, which is the preferred method over URL parameters
For older SODA 2.0/2.1 endpoints, pass the token instead via the $$app_token URL parameter if the header is not honored
Monitor for HTTP 429 responses, which indicate the request volume has been throttled despite (or in the absence of) an application token
Known gotchas
An application token is not a security credential and does not by itself authenticate write access; it only raises the throttling ceiling for read queries, so it must be paired with real authentication for any publishing/write operations
The correct token transport mechanism differs by SODA API version (X-App-Token header for 2.x/3.0 vs. $$app_token or app_token parameter for older versions), and using the wrong one can silently fall back to the low unauthenticated throttling tier
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?