FOOTBALL API
Sign inRequest a key
The collectionDocumentationMembershipStatusSupport
Sign inRequest a key
Documentation / Guides

FOOTBALL API AUTHENTICATION

Authentication

Every call carries your key in a header. This is how to send it, keep it safe and replace it.

SEND THE KEY

Send your key in the X-API-Key header. Authorization: Bearer works too, for tools that only send that header.

X-API-KeyheaderYour key, as it was shown to you.
AuthorizationheaderThe word Bearer, a space, then your key. Read only when there is no X-API-Key.
GET /v1/usage HTTP/1.1
Host: api.footballapi.org
X-API-Key: your key

NEVER IN THE ADDRESS

A key in the address ends up in logs and browser history, so a call with key or api_key in the query is refused with 400 bad_request, before it is counted.

KEEPING IT SAFE

We keep only a fingerprint of your key, never the key, so it cannot be shown again. Call the API from your own server rather than from a public web page, where anyone can read it.

Each account has one key. If it is lost or seen by someone else, replace it from your account: the new key works at once and the old one keeps working for 24 hours, so you can change it over without stopping. Signing in again never changes your key.

WHEN IT IS REFUSED

401unauthorizedNo key, a key we do not know, or a key replaced more than 24 hours ago.
400bad_requestThe key was sent in the address.
PREVIOUSQuick startNEXTPlans and limits