Skip to main content
Every endpoint in The Stats API requires authentication. Authentication is handled via a Bearer token passed in the Authorization header of each HTTP request. There are no cookie-based sessions or API key query parameters — the header is the only supported method.
1

Get your API key

Log in to your account dashboard and navigate to API Keys. Generate a new key and copy it somewhere safe — the full key value is only shown once. If you lose it, you can revoke it and generate a replacement.
2

Add it to your request headers

Include the following header in every request you make to the API. Replace YOUR_API_KEY with the key you copied from the dashboard:
3

Make your first request

With your key in place, make an authenticated request to any endpoint. The example below fetches the list of available competitions:
A successful response returns a 200 OK with the competitions data. If you see a 401 error instead, double-check that your key is correct and has not been revoked.
Keep your API key secret. Never embed it in client-side code, commit it to version control, or expose it in a public repository. Use environment variables or a secrets manager to inject the key at runtime in server-side environments.

​
Authorization header format

The header name is Authorization. The value must begin with the literal string Bearer (note the trailing space) followed immediately by your API key.

​
Authenticated request example

​
Error responses

If your API key is missing or invalid, the API returns a 401 Unauthorized response with the following JSON body:
Common causes of a 401 error:
  • The Authorization header is absent from the request
  • The token is malformed (e.g., missing the Bearer prefix)
  • The API key has been revoked or has expired
  • There is a typo or extra whitespace in the key value