Getting started

Authentication

Every call is authenticated with an API token tied to your account and plan. There is no OAuth flow and no session.

Token query parameter

Add your token to the query string of every call as token=YOUR-TOKEN, next to the other parameters. Copy it from the dashboard.

text

https://api.odds-data-api.com/v3/events/inplay?sport_id=1&token=YOUR-TOKEN

The examples in these docs read the token from an environment variable:

curl "https://api.odds-data-api.com/v3/events/inplay?sport_id=1&token=$ODDS_DATA_API_TOKEN"

X-API-TOKEN header

If you prefer to keep the token out of URLs, send it in the X-API-TOKEN header instead. Both work the same way.

bash

curl -H "X-API-TOKEN: $ODDS_DATA_API_TOKEN" "https://api.odds-data-api.com/v3/events/inplay?sport_id=1"

Keep your token private

Call the API from your server. Do not ship the token in browser code or mobile apps, where anyone can read it.
Keep it in an environment variable or a secret manager, not in your repository.
URLs end up in proxy logs, analytics tools and error reports. Avoid logging full request URLs, or use the header.

Calls with your token count toward your limit

Anyone who has your token can use your plan and your hourly requests. If it leaks, revoke it right away.

Revoke a token

You can hold several active tokens, which lets you replace one without downtime:

Create a new token in the dashboard and name it after the service that uses it.
Deploy the new token and confirm your calls succeed.
Revoke the old token. It stops working immediately and calls with it return AUTHORIZE_FAILED.

All tokens on an account share the same plan and the same hourly limit.

AUTHORIZE_FAILED

A call with a missing, mistyped or revoked token returns AUTHORIZE_FAILED. Check the parameter name, that the variable holding your token is set, and that the token is still active.

application/json

{
  "success": 0,
  "error": "AUTHORIZE_FAILED"
}

A valid token that calls an endpoint or sport outside its plan gets PERMISSION_DENIED instead. See Errors.

application/json

{
  "success": 0,
  "error": "PERMISSION_DENIED"
}