List this account's API keys

GET

/v1/account/keys

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Get,
    RequestUri = new Uri("https://oddslink.app/v1/account/keys"),
    Headers =
    {
        { "Authorization", "Bearer <token>" },
    },
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

package main

import (
  "fmt"
  "net/http"
  "io"
)

func main() {

  url := "https://oddslink.app/v1/account/keys"

  req, _ := http.NewRequest("GET", url, nil)

  req.Header.Add("Authorization", "Bearer <token>")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

OkHttpClient client = new OkHttpClient();

Request request = new Request.Builder()
  .url("https://oddslink.app/v1/account/keys")
  .get()
  .addHeader("Authorization", "Bearer <token>")
  .build();

Response response = client.newCall(request).execute();

const url = 'https://oddslink.app/v1/account/keys';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://oddslink.app/v1/account/keys \
  --header 'Authorization: Bearer <token>'

Signed-in website session only. An X-API-Key is refused here. A key can read its own usage through /v1/account/usage, but it can never list, create or revoke keys, so one leaked key cannot take over the rest.

Authorizations

BearerAuth

Responses

200

This account’s keys. Never includes the full secret.

application/json

Array<object>

object

required

string format: uuid

prefix

required

The key’s non-secret prefix, safe to display, for example ok_live_REDACTED: the key’s own leading ok_live_ or ok_test_, plus its first 8 characters.

string

last_four

required

The key’s last 4 characters, safe to display alongside the prefix so you can tell two of your keys apart even when their prefixes match.

string

>= 4 characters <= 4 characters

label

required

string

test

required

True for a key created with test: true, always clearly marked as test context.

boolean

created_at

required

string format: date-time

last_used_at

required

string | null format: date-time

revoked_at

required

string | null format: date-time

Examples

keys

Two key records, including one revoked key

[
  {
    "id": "8f14e45f-ceea-4c5b-9d1a-1a2b3c4d5e6f",
    "prefix": "ok_live_REDACTED",
    "last_four": "Es9z",
    "label": "My application",
    "test": false,
    "created_at": "2026-09-19T09:00:00.000Z",
    "last_used_at": "2026-09-19T10:02:00.000Z",
    "revoked_at": null
  },
  {
    "id": "3c19f0a2-2b6b-4b8a-9f0d-0a1b2c3d4e5f",
    "prefix": "ok_test_REDACTED",
    "last_four": "208w",
    "label": "Previous integration",
    "test": true,
    "created_at": "2026-07-01T09:00:00.000Z",
    "last_used_at": "2026-07-20T11:00:00.000Z",
    "revoked_at": "2026-08-01T09:00:00.000Z"
  }
]

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

401

The Authorization bearer session is missing or invalid.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

stored_commence_times

Stored Unix-second choices on AMBIGUOUS_EVENT or INVALID_STORED_COMMENCE_TIME; independent of dateFormat.

Array<integer>

valid_bookmakers

Valid case-sensitive book keys on INVALID_BOOKMAKER.

Array<string>

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Examples

No Authorization: Bearer header sent

{
  "error": {
    "code": "MISSING_SESSION",
    "message": "Sign in and try again.",
    "docs_url": "https://oddslink.app/docs/errors/#missing-session",
    "request_id": "req_01hz8k4b9h5y0z1a"
  }
}

Session is expired or invalid

{
  "error": {
    "code": "INVALID_SESSION",
    "message": "Your session has expired. Sign in again.",
    "docs_url": "https://oddslink.app/docs/errors/#invalid-session",
    "request_id": "req_01hz8k4c0j6z1a2b"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

429

The plan’s speed limit was exceeded; wait Retry-After seconds. A call that does not count against the allowance is never refused for a spent allowance.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

stored_commence_times

Stored Unix-second choices on AMBIGUOUS_EVENT or INVALID_STORED_COMMENCE_TIME; independent of dateFormat.

Array<integer>

valid_bookmakers

Valid case-sensitive book keys on INVALID_BOOKMAKER.

Array<string>

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Example

{
  "error": {
    "code": "SPEED_LIMIT",
    "message": "Speed limit exceeded: 10 requests/second on the Growth plan.",
    "docs_url": "https://oddslink.app/docs/errors/#speed-limit",
    "request_id": "req_01hz8k4f7m9c3d8f"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

Retry-After

integer

Seconds to wait before retrying on 429 SPEED_LIMIT or 503 ODDS_UNAVAILABLE.

5XX

Something failed on our side.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

stored_commence_times

Stored Unix-second choices on AMBIGUOUS_EVENT or INVALID_STORED_COMMENCE_TIME; independent of dateFormat.

Array<integer>

valid_bookmakers

Valid case-sensitive book keys on INVALID_BOOKMAKER.

Array<string>

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Example

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Something went wrong on our side. It has been logged.",
    "docs_url": "https://oddslink.app/docs/errors/#internal-error",
    "request_id": "req_01hz8k4h8n0d4e9f"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.