Skip to main content
Every request to the SportriX API is authenticated with an API key. Keys are opaque strings prefixed with sk_ and are issued to your account by the SportriX team. There are no sessions, cookies, or OAuth flows — just include your key on every request.
Keep your API key secret. Do not expose it in client-side JavaScript, mobile app bundles, or public repositories. If a key is compromised, contact support to disable it immediately.

​
Passing your key

​
REST API — X-API-Key header

The standard and recommended way to authenticate REST requests is the X-API-Key header:
Include this header on every request. The only endpoint that does not require authentication is GET /health.

​
WebSocket — header or query parameter

For WebSocket connections, you can authenticate using either method: X-API-Key header (preferred for server-side clients):
key query parameter (useful for browser clients that cannot set WebSocket headers):
The connection is rejected with HTTP 401 during the handshake if the key is invalid or lacks the required scope.

​
Authentication errors

All error responses include a JSON body with a detail field explaining the reason:

​
Key management

Keys are issued per account (called a client in the API). A single client account can have multiple API keys — for example, one key per environment (development, staging, production) or one per team. All keys belonging to a client inherit the same set of scopes and sport allowlist. A key can be in any of these states: Contact support to create, disable, or adjust the expiry on a key.

​
Scopes

Each key inherits the scopes granted to your client account. Scopes control which endpoints you can call — attempting an endpoint your key lacks permission for returns 403 Forbidden.
You can see which scopes your key covers in your account dashboard or by contacting support. For a full description of what each scope unlocks, see Scopes.
The Passthrough API runs on a different host (passthrough.sportrix.ai) and requires a sportsbook grant alongside the odds scope. Its error bodies use error rather than detail. See Passthrough API authentication.