Authentication

Every call carries your key in a header. Keys in the address are refused.

Two headers, either works

curl

curl https://api.tabletennisapi.com/v1/usage -H "Authorization: Bearer tta_live_..."
curl https://api.tabletennisapi.com/v1/usage -H "X-API-Key: tta_live_..."

Why not in the address

Addresses end up in server logs, browser history and analytics. A call with ?key= or ?api_key= is refused with 400 bad_request so a key never leaks that way by accident.

Missing or revoked keys

A call without a key, or with a revoked one, gets 401 unauthorized. Make a new key in your dashboard; revoking the old one takes effect at once.

One key, any plan

Your key stays the same when you change plan. The plan decides what it can read, not the key.