Skip to content
Get a key
Get started / Keys and authentication

Keys and authentication

Every request carries your key in one header. There are no tokens to refresh and no sessions to keep alive.

Send your key

Add the header Authorization: Bearer sk_live_… to every request. X-API-Key: sk_live_… works too. Requests without a valid key get a 401 response.

curl "https://api.sportstatsapi.com/api/v1/soccer/matches/live" \ -H "Authorization: Bearer $SPORTSTATS_KEY"

Keep it safe

  • Store the key in an environment variable or your secret manager, never in code you commit.
  • Call the API from your server or a serverless function, then send your own visitors only what they need.
  • If a key leaks, rotate it in your account. The old key stops working at once.

What a key can reach

A key answers for the sports and the Insights level in your plan. A request for another sport returns 403 with the code FORBIDDEN, and Insights without the Insights plan returns FEATURE_NOT_IN_PLAN, so you can show a clear message instead of an empty page.

No key: pay per call

AI agents that pay per call need no key and no account. A request without a key gets 402 with the price; pay it in USDC on Base (x402) and repeat the request with the PAYMENT-SIGNATURE header. Only a 200 answer is charged. Prices and payment offers are at api.sportstatsapi.com/.well-known/x402; see AI agents.

PreviousQuickstartNextErrors and limits
Was this page helpful?