API keys
API keys let scripts and integrations reach your account, limited to what you give them. A leaked key can’t take over the account: keys can’t manage devices or other keys, act as a watch, or sign in.
Making a key
Section titled “Making a key”Under Settings → API keys, choose New key, and give it:
- A name, so you can tell your keys apart.
- Access to each area: none, read, or read and write. The areas are matches, match reports, venues, referees, competitions, templates and settings.
- An expiry: 30 days, 90 days (the default), a year, or never.
The key is shown once. The server keeps only a hash, so a lost key has to be replaced, not recovered. An account can have up to 20 keys.
Using a key
Section titled “Using a key”curl https://lawfive.example.com/v1/venues \ -H "Authorization: Bearer lf_your_key"| Answer | Meaning |
|---|---|
401 |
The key is unknown, deleted or expired. The answer says which. |
403 |
The key doesn’t have that access. The answer says what it would need. |
What needs which access
Section titled “What needs which access”Each endpoint in the reference says what a key needs. A few aren’t obvious:
- Weather needs matches read.
- Address search needs venues read and write.
GET /v1/changesincludes only the areas the key can read.
Endpoints are closed to keys unless their description gives a scope.
Deleting a key
Section titled “Deleting a key”Delete in the list stops it working straight away. Keys don’t appear in the Devices list.