List this account's API keys

GET

/v1/account/keys

const url = 'https://oddslink.app/v1/account/keys';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://oddslink.app/v1/account/keys \
  --header 'Authorization: Bearer <token>'

Signed-in website session only. An X-API-Key is refused here. A key can read its own usage through /v1/account/usage, but it can never list, create or revoke keys, so one leaked key cannot take over the rest.

Authorizations

BearerAuth

Responses

200

This account’s keys. Never includes the full secret.

application/json

Array<object>

object

required

string format: uuid

prefix

required

The key’s non-secret prefix, safe to display, for example ok_live_Q3v9Tb2K: the key’s own leading ok_live_ or ok_test_, plus its first 8 characters.

string

last_four

required

The key’s last 4 characters, safe to display alongside the prefix so you can tell two of your keys apart even when their prefixes match.

string

>= 4 characters <= 4 characters

label

required

string

test

required

True for a key created with test: true, always clearly marked as test context.

boolean

created_at

required

string format: date-time

last_used_at

required

string | null format: date-time

revoked_at

required

string | null format: date-time

Examples

keys

A live key and a revoked test key

[
  {
    "id": "8f14e45f-ceea-4c5b-9d1a-1a2b3c4d5e6f",
    "prefix": "ok_live_Q3v9Tb2K",
    "last_four": "Es9z",
    "label": "production server",
    "test": false,
    "created_at": "2026-09-19T09:00:00Z",
    "last_used_at": "2026-09-19T10:02:00Z",
    "revoked_at": null
  },
  {
    "id": "3c19f0a2-2b6b-4b8a-9f0d-0a1b2c3d4e5f",
    "prefix": "ok_test_XDOVgX-e",
    "last_four": "208w",
    "label": "staging (old)",
    "test": true,
    "created_at": "2026-07-01T09:00:00Z",
    "last_used_at": "2026-07-20T11:00:00Z",
    "revoked_at": "2026-08-01T09:00:00Z"
  }
]

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

401

The API key (or session) is missing or invalid.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Examples

No X-API-Key header sent

{
  "error": {
    "code": "MISSING_KEY",
    "message": "X-API-Key header is missing.",
    "docs_url": "https://oddslink.app/docs/errors/#missing-key",
    "request_id": "req_01hz8k4a1f3w7x2y"
  }
}

Key does not exist or was revoked

{
  "error": {
    "code": "INVALID_KEY",
    "message": "API key is not valid.",
    "docs_url": "https://oddslink.app/docs/errors/#invalid-key",
    "request_id": "req_01hz8k4b2g4x8y3z"
  }
}

No Authorization: Bearer header sent (account endpoints only)

{
  "error": {
    "code": "MISSING_SESSION",
    "message": "Sign in and try again.",
    "docs_url": "https://oddslink.app/docs/errors/#missing-session",
    "request_id": "req_01hz8k4b9h5y0z1a"
  }
}

Session is expired or invalid (account endpoints only)

{
  "error": {
    "code": "INVALID_SESSION",
    "message": "Your session has expired. Sign in again.",
    "docs_url": "https://oddslink.app/docs/errors/#invalid-session",
    "request_id": "req_01hz8k4c0j6z1a2b"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

429

The plan’s speed limit was exceeded; wait Retry-After seconds. A call that does not count against the allowance is never refused for a spent allowance.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Example

{
  "error": {
    "code": "SPEED_LIMIT",
    "message": "Speed limit exceeded: 10 requests/second on the Growth plan.",
    "docs_url": "https://oddslink.app/docs/errors/#speed-limit",
    "request_id": "req_01hz8k4f7m9c3d8f"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.

Retry-After

integer

Seconds to wait before retrying (429 SPEED_LIMIT only).

5XX

Something failed on our side.

application/json

object

error

required

object

code

required

string

message

required

string

docs_url

required

string format: uri

request_id

required

string

current_plan

403 only: the plan on the presented key.

string

required_plan

403 only: the lowest plan that includes this request. For history, that depends on how long ago the fixture started as well as on the endpoint.

string

Example

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Something went wrong on our side. It has been logged.",
    "docs_url": "https://oddslink.app/docs/errors/#internal-error",
    "request_id": "req_01hz8k4h8n0d4e9f"
  }
}

Headers

x-requests-used

integer

Requests used this billing period.

x-requests-remaining

integer

Requests remaining this billing period.

x-requests-last

integer

What this one call cost against the allowance (0 for a free call).

X-RateLimit-Limit

integer

This plan’s speed limit, in requests per second.

X-RateLimit-Remaining

integer

Requests left in the current one-second window.

X-RateLimit-Reset

integer

Seconds until the speed-limit window resets.

X-Request-Id

string

This request’s id, for support and for matching against error.request_id.