Authentication

API key

Every operation except `/v1/account/keys` accepts this. There is no `?apiKey=` query fallback.

curl "https://oddslink.app/v1/sports" \
  -H "X-API-Key: ok_live_..."

Signed-in session

A signed-in website session's access token. Required by `/v1/account/keys`. An `X-API-Key` is refused there: only a signed-in customer creates or revokes keys.

Auth error codes

Every one of these is returned as a normal 401 with the standard error body.

Code	Message	Anchor
MISSING_KEY	X-API-Key header is missing.	/docs/errors/#missing-key
INVALID_KEY	API key is not valid.	/docs/errors/#invalid-key
MISSING_SESSION	Sign in and try again.	/docs/errors/#missing-session
INVALID_SESSION	Your session has expired. Sign in again.	/docs/errors/#invalid-session