Your key

A key reads what its owner reads. You entered your rosters, so your key gets the full names of the children on them. Anybody else looking at your team in this product gets a first name and a last initial.

That is what makes the key useful, and it is also the whole risk. Put the key in your website’s own code, in a phone app, or anywhere a browser downloads it, and every visitor can read it out and ask for those names themselves. Call us from your server, and send your visitors what you want them to see.

One header, on every request. There is no other accepted form.

Authorization: Bearer tb_live_…

Never put a key in the address. A key in a query string is refused, because it lands in server logs, in browser history and in the referrer header of the next page a visitor opens. The refusal is key-in-url, and it is on the Limits and errors page.

Each team has its own key. Put a team in a slot on the plan screen (Choose a team), and that team gets a key at once. Press Turn off, and the key stops working at once. Turning the team on again gives it a new key. You do not name a key and you do not make one by hand.

The key is always there to read. Open the team in the app, open its API page, press Copy key, and paste it where it goes. The same page shows when the key was last used. Only the account owner sees that page.

A key reads one team: that team, its roster, its games, each game, the live score, the plays, the box score, the event log, the season table, and the children on that team. Ask the same key for another team, and it is refused with key-scope — even when that other team is yours. Use that team’s own key.

A key reads a child’s season on its own team only. A child who also plays, or played, on another of your teams has a separate page there, and that team’s own key reads it.

A team whose Data API is off is refused with no-api-seat, and has no key at all.

When a team is turned off or leaves its slot, its key stops. A request with that key then answers not-authenticated, the same as a key that never existed.

Nothing a key can do writes. There is no key that writes, and no plan that buys one.

Press Replace key on the team’s API page and confirm. That team gets a new key, and the old one stops reading the same second. Nothing else you own is touched, and no other team’s key changes.

So a key you think somebody else has is a key to replace: copy the new one, change your server, and the old one is already dead.

Every team shows when its key was last used. A team you are not reading, that says it was read a minute ago, is a team whose key to replace now.

Every key has the same shape. Give this pattern to your secret scanner, so a key pushed to a repository by mistake is caught before anybody else finds it.

tb_live_[A-Za-z0-9]{32}