Create a new API key

POST

/v1/account/keys

const url = 'https://oddslink.app/v1/account/keys';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"label":"production server","test":false}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://oddslink.app/v1/account/keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "label": "production server", "test": false }'

Signed-in website session only. The full secret is returned exactly once, in this response. We do not store the plaintext and cannot show it again. Key prefixes are ok_live_ for a normal key and ok_test_ for a test key, always clearly marked as test context.

Authorizations

BearerAuth

Request Body^required

application/json

object

label

required

string

>= 1 characters <= 64 characters

test

Create an ok_test_-prefixed key instead of a live one.

boolean

Examples

create

{
  "label": "production server",
  "test": false
}

Responses

201

The new key, with its one-time secret.

application/json

object

required

string format: uuid

prefix

required

The key’s non-secret prefix, safe to display, for example ok_live_Q3v9Tb2K: the key’s own leading ok_live_ or ok_test_, plus its first 8 characters.

string

last_four

required

The key’s last 4 characters, safe to display alongside the prefix so you can tell two of your keys apart even when their prefixes match.

string

>= 4 characters <= 4 characters

label

required

string

test

required

True for a key created with test: true, always clearly marked as test context.

boolean

created_at

required

string format: date-time

last_used_at

required

string | null format: date-time

revoked_at

required

string | null format: date-time

key

required

The full secret. Returned only here, only once. We do not store the plaintext.

string

Examples

created

{
  "id": "8f14e45f-ceea-4c5b-9d1a-1a2b3c4d5e6f",
  "prefix": "ok_live_Q3v9Tb2K",
  "last_four": "Es9z",
  "key": "ok_live_Q3v9Tb2KcWHFpOjQnLqLhrLoFMtNKwR7t7NTq-8Es9z",
  "label": "production server",
  "test": false,
  "created_at": "2026-09-19T09:00:00Z",
  "last_used_at": null,
  "revoked_at": null
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

400

A parameter was malformed.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Example

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "commenceTimeFrom is not a valid ISO-8601 timestamp.",
    "docs_url": "https://oddslink.app/docs/errors/#bad-request",
    "request_id": "req_01hz8k3z9e2v6w1x"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

401

The API key (or session) is missing or invalid.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Examples

No X-API-Key header sent

{
  "error": {
    "code": "MISSING_KEY",
    "message": "X-API-Key header is missing.",
    "docs_url": "https://oddslink.app/docs/errors/#missing-key",
    "request_id": "req_01hz8k4a1f3w7x2y"
  }
}

Key does not exist or was revoked

{
  "error": {
    "code": "INVALID_KEY",
    "message": "API key is not valid.",
    "docs_url": "https://oddslink.app/docs/errors/#invalid-key",
    "request_id": "req_01hz8k4b2g4x8y3z"
  }
}

No Authorization: Bearer header sent (account endpoints only)

{
  "error": {
    "code": "MISSING_SESSION",
    "message": "Sign in and try again.",
    "docs_url": "https://oddslink.app/docs/errors/#missing-session",
    "request_id": "req_01hz8k4b9h5y0z1a"
  }
}

Session is expired or invalid (account endpoints only)

{
  "error": {
    "code": "INVALID_SESSION",
    "message": "Your session has expired. Sign in again.",
    "docs_url": "https://oddslink.app/docs/errors/#invalid-session",
    "request_id": "req_01hz8k4c0j6z1a2b"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

429

The plan’s speed limit was exceeded; wait Retry-After seconds. A call that does not count against the allowance is never refused for a spent allowance.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Example

{
  "error": {
    "code": "SPEED_LIMIT",
    "message": "Speed limit exceeded: 10 requests/second on the Growth plan.",
    "docs_url": "https://oddslink.app/docs/errors/#speed-limit",
    "request_id": "req_01hz8k4f7m9c3d8f"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

Retry-After

integer

Seconds to wait before retrying (429 SPEED_LIMIT only).

5XX

Something failed on our side.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Example

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Something went wrong on our side. It has been logged.",
    "docs_url": "https://oddslink.app/docs/errors/#internal-error",
    "request_id": "req_01hz8k4h8n0d4e9f"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

Create a new API key

Authorizations

Request Bodyrequired

Examples

Responses

201

Examples

Headers

400

Example

Headers

401

Examples

Headers

429

Example

Headers

5XX

Example

Headers

Request Body^required