Send a key
Create a named key in the dashboard. The full value is shown once; Stats API stores only its SHA-256 hash.
Send the key in the HTTP Authorization header. Query-string keys are not supported because URLs commonly appear in logs, analytics, and browser history.
Example
curl "https://stats-api.com/api/v1/football/competitions?limit=10" \
-H "Authorization: Bearer $STATS_API_KEY"Key lifecycle
Use one key per deployed application or environment so a compromised integration can be revoked without interrupting the others.
- Store keys in server-side environment variables or a secret manager.
- Never commit a key, put it in client-side JavaScript, or paste it into a public issue.
- Create a replacement before revoking an active key when rotating without downtime.
- A user may keep up to ten active keys. Revoked keys remain visible for audit history and do not count toward that active-key limit.
Authentication errors
| HTTP | Code | Meaning |
|---|---|---|
| 401 | invalid_api_key | The bearer credential is missing, malformed, unknown, or revoked. |
| 403 | subscription_inactive | The key is valid, but its account has no current API entitlement. Keep the key and restore or choose a plan. |
| 429 | rate_limit | The per-minute allowance has been exhausted. |
| 429 | monthly_quota | The subscription request allowance has been exhausted. |