Authentication
How to authenticate requests to the Tournament Suite public Data API using a project-scoped API key.
The Tournament Suite public Data API authenticates every request with a project-scoped API key sent in the X-API-Key header. There is no separate OAuth 2 flow for calling the API — see OAuth 2 if you're looking for how Tournament Suite uses OAuth 2 for organization single sign-on instead.
API key authentication
Include your key in the X-API-Key header on every request:
curl https://api.tournamentsuite.com/api/v1/data/tournaments \
-H "X-API-Key: YOUR_API_KEY"const apiClient = axios.create({
baseURL: 'https://api.tournamentsuite.com/api/v1/data',
headers: { 'X-API-Key': process.env.TOURNAMENTSUITE_API_KEY },
});API keys are generated in your project's Developer section of the organizer dashboard (a top-level entry in the project sidebar). Each key is shown only once — store it securely in an environment variable or secrets manager.
Never embed API keys in client-side code, mobile app bundles, or public repositories.
Plan requirement
Access to the Data API also depends on your project's subscription plan. Even with a valid key and the correct scope, a request is rejected if the project's current plan doesn't include the Developer API capability — this is a separate check from scopes, and it returns its own 403 (see below). Upgrade the project's plan to resolve it.
Authentication errors
| Status | Error code | Meaning |
|---|---|---|
401 | UNAUTHORIZED | The X-API-Key header is missing, or the key is invalid, inactive, or revoked |
403 | FORBIDDEN | The key is missing a required scope, the project's plan doesn't include the Developer API capability, or the request came from an IP outside the key's allow list — check error.message for which one applies |
429 | TOO_MANY_REQUESTS | The key's own rate limit or its plan tier's rate limit was exceeded |
Next steps
- Authorization & Scopes
- Authorization
- OAuth 2 — organization single sign-on, not API authentication
Was this helpful?