Authentication

Every request to the API is authenticated with an API key — an opaque token you create in your dashboard. Keys are validated on each request; there are no sessions, cookies, or OAuth flows.

Passing your key

Pass the key in the Authorization: Bearer header — the primary scheme:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.esportsodds.gg/v1/cs2/matches"

For callers that can't set a header, the apiKey query parameter is a supported fallback (the same convention the-odds-api.com uses):

curl "https://api.esportsodds.gg/v1/cs2/matches?apiKey=YOUR_API_KEY"

If both are present, the header wins. Either applies to every REST endpoint; the WebSocket channel instead uses a short-lived connection ticket minted from POST /v1/{game}/ws-token, so the raw key never appears in a socket URL.

Keep your key server-side. If you're building a browser or mobile client, proxy requests through your own backend rather than shipping the raw key to the client — the same way this site's public demo mints a short-lived connection token server-side instead of exposing its key.

How keys are stored

Only a SHA-256 hash of your key is stored — never the raw value. If you lose a key, rotate it from the dashboard; a compromised database never yields usable keys.

Missing or invalid keys

The 401 body is deliberately identical for "no such key" and "revoked key" — the response never reveals which case occurred. See Errors for the body shape.

Usage & billing

Each authenticated request records a usage event against your key. Pricing is a single $99/mo plan (10,000 requests/month, no free tier) — see pricing. The monthly quota is enforced: past 10,000 requests in a calendar month the API responds 429 until the month resets (see Rate limits). Your current usage is visible in the dashboard and in the X-Quota-* headers on every response.