Authentication

Every API request must include a valid partner API key.

Headers

Send your key using either header (same permissions):

Authorization: Bearer pr_live_YOUR_API_KEY
# or
X-API-Key: pr_live_YOUR_API_KEY

Key format

Keys look like pr_live_… or pr_test_…. Live keys require an active subscription. Test keys (when enabled) hit the same API with sandbox billing flags.

Scopes

Each key carries scopes. Missing scope → 403 forbidden.

  • read:players — GET player, search
  • read:rankings — GET rankings
  • read:intelligence — POST predict
  • write:players — POST players
  • write:matches — POST/GET matches
  • write:external-ratings — import priors

Security practices

  • Never expose keys in mobile apps or front-end JavaScript
  • Rotate keys from the dashboard if leaked
  • Use separate keys per environment (staging vs production)
  • Pass X-Request-Id for support correlation (optional; we echo it back)