Authentication
Last updated 2026-10-30
Every data request needs your API key in the x-api-key HTTP header. The base URL is https://api.bettingdataapi.com. Only GET /sports/ works without a key.
Send the key in a header
curl -H "x-api-key: YOUR_API_KEY" "https://api.bettingdataapi.com/me/"
GET /me/ returns your plan and today's usage and does not use quota, so it is the safest first call.
Query-string fallback for quick browser tests
For a one-off test in a browser you can pass the key as ?apiKey=YOUR_KEY or ?x-api-key=YOUR_KEY. Do not do this in production: URLs end up in logs, browser history and analytics.
https://api.bettingdataapi.com/me/?apiKey=YOUR_API_KEY
Endpoints that do not need a key
GET /sports/ is public so you can browse the catalog before signing up. Each sport carries a min_tier field (Free, Pro or Business). With a key, the list is filtered to what your plan can access.
Authentication errors
| Status | Meaning | Fix |
|---|---|---|
| 401 | Missing API key, or the key is not recognized. | Send the key in x-api-key. Check for stray spaces or quotes. |
| 403 | The key is valid but the endpoint or sport is not on your plan. | The message names the plan you need. |
| 429 | Daily quota reached, or too many failed authentication attempts from one IP address. | Honor Retry-After. See rate limits. |
A real 401 body looks like this:
{"detail":"Missing API key. Provide it via the `x-api-key` HTTP header (recommended), or as a query param `?apiKey=YOUR_KEY` (or `?x-api-key=YOUR_KEY`) for browser testing. Do not embed keys in URLs in production."}Keep keys server-side
- Store the key in an environment variable or secret manager, not in source control.
- Call the API from your backend. A key embedded in browser or mobile code can be copied by anyone.
- If a key is exposed, email hello@bettingdataapi.com and we will replace it. See API keys.
Try it with a free key
25 requests per day, NFL, NBA and MLB moneylines, no credit card.
Get a free API key