Authentication
Every Starter route is authenticated with a single header. The key stays server-side, always.
Send the key in the header
Every Starter route requires the real request header below, over HTTPS:
X-API-Key: your_api_keyThe key is never accepted in a URL or query string.
Keep the key server-side
Never expose an API key in public browser JavaScript, a mobile
bundle, a repository, a screenshot, or logs. Use an environment variable or a secret manager, and
rotate the key if you suspect exposure.
export FORESPORTIA_API_KEY="your_api_key"The official Python SDK reads the key from the environment with ForesportiaClient.from_env()
and never puts it in URLs, repr(), logs, or exceptions.
Authentication errors
| Status | Meaning |
|---|---|
401 | The key is missing, invalid, inactive, or revoked. |
403 | The key is valid but not authorized for this contract, competition, or operation. |
Authentication proves the client identity. Competition authorization is checked separately — see Competitions.