Create and manage API keys

An API key is a credential that authenticates requests from your server or integration to the Tournament Suite API. Each key carries a defined set of permissions (scopes) that control what the key can read or modify. Keys are not tied to a user account, so they continue to work even if team members change.

Where to find it

Developer → API Keys

Step by step

1. Go to Developer → API Keys and click Create API key.
2. Enter a descriptive name for the key so you can identify its purpose later — for example, Production integration or Data sync script.
3. Select the scopes the key should have. Grant only the permissions the integration actually needs:
   • Read-only scopes for data retrieval
   • Write scopes for creating or updating resources
   • Specific resource scopes (e.g. tournaments, registrations, matches) to limit access
4. Optionally set an expiration, in days, for the key. It defaults to 90 days; leave it as-is, increase it, or clear it if the integration should not expire automatically. Once a key's expiration date passes, it stops working.
5. Click Create.
6. Copy the generated key immediately. The full key value is shown only once. If you close the page without copying it, you cannot view it again — use Rotate (see below) to issue a new secret without losing the key's name, scopes, or expiration.
7. Store the key in a secrets manager or environment variable. Do not commit it to source code or share it in plain text.

Managing existing keys

• The API Keys list shows all active keys, their assigned scopes, expiration (if set), and the last time each key was used.
• To issue a new secret for a key without changing its name, scopes, or expiration, click Rotate. This immediately invalidates the old secret and generates a replacement — copy it right away, since it is also shown only once. Rotate is the recommended way to recover a key whose secret was lost, or to replace the secret of a key that may have been exposed, since it does not disrupt the key's identity or permissions.
• To remove a key entirely, click Revoke. Revocation is immediate and permanent — any integration using that key will lose access, and you will need to create a new key (with new scopes and expiration) to restore it. Only revoke a key if you no longer want it to exist, or if you need to change its scopes — otherwise, prefer Rotate.

Testing your integration

Use the API Reference (Developer → API Reference) to browse available endpoints and understand request and response formats. Use the Sandbox (Developer → Sandbox) to run test calls against a non-production environment before going live.

Note: API access may be gated by your project plan. If you do not see the Developer section or cannot create keys, check your plan at Projects → [Project] → Settings → Billing.

What happens next

With a key in hand, you can authenticate API requests and start building your integration. If you need your server to receive real-time event notifications rather than poll the API, set up a Webhook. To connect Tournament Suite to a Discord server, see Discord Integration.