Authentication

The X-API-Key header, and the one signed-in-session endpoint.

API key

Every operation except `/v1/account/keys` accepts this. There is no `?apiKey=` query fallback. Create one from Account after you sign in. Save the full value when it is created: only its prefix and final characters remain available afterward.

GET/v1/sports

curl --request GET \
  --url "https://oddslink.app/v1/sports" \
  --header "X-API-Key: ok_live_..." \
  --compressed

import requests
import json

resp = requests.get(
    "https://oddslink.app/v1/sports",
    headers={"X-API-Key": "ok_live_..."},
    timeout=60,
)
resp.raise_for_status()
data = resp.json()
print(json.dumps(data, indent=2))

async function main() {
  const res = await fetch(
    "https://oddslink.app/v1/sports",
    { headers: { "X-API-Key": "ok_live_..." } }
  );
  if (!res.ok) throw new Error((await res.json()).error.code);
  const data = await res.json();
  console.log(JSON.stringify(data, null, 2));
}

main().catch((error) => {
  console.error(error);
  process.exitCode = 1;
});

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("GET",
		"https://oddslink.app/v1/sports", nil)
	req.Header.Set("X-API-Key", "ok_live_...")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

<?php
$ch = curl_init("https://oddslink.app/v1/sports");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_ENCODING => "",
    CURLOPT_HTTPHEADER => ["X-API-Key: ok_live_..."],
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

200 OKresponse.json

[
  {
    "key": "nfl",
    "group": "American Football",
    "title": "NFL",
    "description": "US Football",
    "active": true,
    "has_outrights": false
  },
  {
    "key": "nba",
    "group": "Basketball",
    "title": "NBA",
    "description": "US Basketball",
    "active": false,
    "has_outrights": false
  },
  {
    "key": "epl",
    "group": "Soccer",
    "title": "EPL",
    "description": "English Premier League",
    "active": true,
    "has_outrights": false
  },
  {
    "key": "tennis_atp_hangzhou",
    "group": "Tennis",
    "title": "ATP Hangzhou",
    "description": "Tennis",
    "active": true,
    "has_outrights": false
  }
]

Signed-in session

A signed-in website session's access token. Required by `/v1/account/keys`. An `X-API-Key` is refused there: only a signed-in customer creates or revokes keys. Use it only in the Account experience to create, list, or revoke API keys. The session-authenticated POST /v1/account/keys returns the new secret once; use the API key it returns in X-API-Key for odds requests.

Auth error codes

Every one of these is returned as a normal 401 with the standard error body.

Code	Message	Anchor
`MISSING_KEY`	X-API-Key header is missing.	/docs/errors/#missing-key
`INVALID_KEY`	API key is not valid.	/docs/errors/#invalid-key
`MISSING_SESSION`	Sign in and try again.	/docs/errors/#missing-session
`INVALID_SESSION`	Your session has expired. Sign in again.	/docs/errors/#invalid-session