Send a key
Create a named key in the dashboard. The full value is shown once; Stats API stores only its SHA-256 hash.
Send the key in the HTTP Authorization header. Query-string keys are not supported because URLs commonly appear in logs, analytics, and browser history.
Example
curl "https://stats-api.com/v1/football/competitions?limit=10" \
-H "Authorization: Bearer $STATS_API_KEY"Key lifecycle
Use one key per deployed application or environment so a compromised integration can be revoked without interrupting the others.
- Store keys in server-side environment variables or a secret manager.
- Never commit a key, put it in client-side JavaScript, or paste it into a public issue.
- Create a replacement before revoking an active key when rotating without downtime.
- A user may keep up to ten active and revoked key records for clear audit history.
Authentication errors
| HTTP | Code | Meaning |
|---|---|---|
| 401 | missing_api_key | No bearer credential was supplied. |
| 401 | invalid_api_key | The key is malformed, unknown, or revoked. |
| 403 | subscription_inactive | The account does not currently have API access. |
| 429 | rate_limit_exceeded | The per-minute allowance has been exhausted. |