Your key

A key reads what its owner reads. You entered your rosters, so your key gets the full names of the children on them. Anybody else looking at your team in this product gets a first name and a last initial.

That is what makes the key useful, and it is also the whole risk. Put the key in your website’s own code, in a phone app, or anywhere a browser downloads it, and every visitor can read it out and ask for those names themselves. Call us from your server, and send your visitors what you want them to see.

One header, on every request. There is no other accepted form.

Authorization: Bearer tb_live_…

Never put a key in the address. A key in a query string is refused, because it lands in server logs, in browser history and in the referrer header of the next page a visitor opens. The refusal is key-in-url, and it is on the Limits and errors page.

Each team has its own key. Turn on the switch for a team on the plan screen, and that team gets a key at once. Turn the switch off, and the key stops working at once. You do not name a key and you do not make one by hand.

The key is always there to read. Open the plan screen, press Copy key on the team you want, and paste it where it goes. Every team also shows when its key was last used.

A key reads one team: that team, its roster, its games, each game, the live score, the plays, the box score, the event log, the season table, and the children on that team. Ask the same key for another team, and it is refused with key-scope — even when that other team is yours. Use that team’s own key.

A child who played for you in an earlier season shows that season too, but only when that earlier team also has a seat. The career total counts the same seasons.

A team with no seat is refused with no-api-seat, and a team with no seat has no key at all.

Nothing a key can do writes. There is no key that writes, and no plan that buys one.

Press Regenerate on the team’s row and confirm. That team gets a new key, and the old one stops reading the same second. Nothing else you own is touched, and no other team’s key changes.

So a key you think somebody else has is a key to regenerate: copy the new one, change your server, and the old one is already dead.

Every team shows when its key was last used. A team you are not reading, that says it was read a minute ago, is a team to regenerate now.

Every key has the same shape. Give this pattern to your secret scanner, so a key pushed to a repository by mistake is caught before anybody else finds it.

tb_live_[A-Za-z0-9]{32}