Authentication — API Keys

Obtaining your API key

API keys authenticate requests to the endpoints. They are static credentials tied to a user account. Contact SquadAssist to obtain an API key for your account.

Sending your API key

You can pass the API key in either of two ways. Both are accepted on every endpoint.

curl https://api.squadassist.ai/v1/player_positions \
  -H "x-api-key: <your-api-key>"

curl https://api.squadassist.ai/api/player_positions \
  -H "Authorization: Bearer <your-api-key>"

The x-api-key header is the recommended style for server-to-server requests as it avoids ambiguity with JWT Bearer tokens.

API keys are sensitive credentials. Never expose them in client-side code, commit them to version control, or log them. Store them in environment variables or a secrets manager.

Authentication errors

Both authentication methods return the same HTTP status codes when credentials are missing or invalid.

Status	Body	Cause
`401`	`{"error": "Missing API key"}`	No API key was sent in the request
`401`	`{"error": "Invalid API key"}`	The API key is not recognised or has an invalid format
`401`	`{"error": "API key is revoked"}`	The key has been revoked and can no longer be used
`401`	`{"error": "Invalid email or password"}`	Credentials supplied to `/auth/login` are incorrect
`403`	`{"error": "Account access denied: <reason>"}`	Your account exists but is inactive, not yet activated, or does not have access on your current plan

If you receive a 403 with an account access denied message, contact SquadAssist to review your account status or plan.

Overview

Players

Clubs

Competitions

Predictions

Authentication — API Keys

Obtaining your API key

Sending your API key

Authentication errors

​Obtaining your API key

​Sending your API key

​Authentication errors

Obtaining your API key

Sending your API key

Authentication errors