Getting Started

Authentication

Every request authenticates with an API key sent in the X-API-Key header.

API keys

Keys are issued from the developer dashboard. A key grants read access to the odds, events and scores endpoints. You can rotate or revoke keys at any time; revocation takes effect immediately.

Key type	Prefix	Use
Sandbox	sk_test_	Development and integration testing
Production	sk_live_	Live traffic; requires production access approval

Authenticating requests

Send your key in the X-API-Key request header. Requests without a valid key return 401 authentication_failed.

cURL

curl https://api.openoddsapi.com/v1/sports \
  -H "X-API-Key: sk_live_9f2c1b7e4d8a"

JavaScript

const res = await fetch("https://api.openoddsapi.com/v1/sports", {
  headers: { "X-API-Key": "sk_live_9f2c1b7e4d8a" }
});
if (res.status === 401) {
  console.error("Bad or missing API key");
}

Python

import requests

res = requests.get(
    "https://api.openoddsapi.com/v1/sports",
    headers={"X-API-Key": "sk_live_9f2c1b7e4d8a"},
)
if res.status_code == 401:
    raise SystemExit("Bad or missing API key")

WARNINGNever expose your API key in client-side code. Keys shipped in browsers or mobile apps can be extracted and abused. Route production requests through your own server and keep keys server-side.

Key scoping

Keys are scoped to the odds:read permission by default. Production keys can be restricted to individual sport groups (for example, combat sports only) from the dashboard. Restricted keys receive a 403 forbidden error for sports outside their scope.