---
id: authentication-and-access
title: Sport Line API — Authentication and Access
description: Instructions for obtaining access, passing an API key, and authenticating Sport Line API requests securely.
version: v1
language: en
---

# Sport Line API — Authentication and Access

## How API Access Works

To use Sport Line API, the client receives the following from the SportAPI manager:

- the sports line base URL;
- a personal API key;
- the available sports;
- the available languages;
- the access expiration date;
- the terms of the selected subscription package.

The API key is associated with the client's subscription. The API uses it to verify the
access period and the list of available sports and languages. If the requested data is
not included in the subscription, the API will return an access error or omit that data
from the response.

To obtain access, contact the
[SportAPI manager on Telegram](https://t.me/suport_sportapi).

## The `Package` Header

Send your API key in the `Package` HTTP header with every request:

```http
Package: YOUR_API_KEY
```

Request URL:

```http
GET https://YOUR_API_DOMAIN/v1/menu/live/en
```

Request HTTP headers:

```http
Package: YOUR_API_KEY
Accept: application/json
```

The `YOUR_API_KEY` value must be sent in the `Package` header, not in the URL.

The complete HTTP request looks like this:

```http
GET /v1/menu/live/en HTTP/1.1
Host: YOUR_API_DOMAIN
Package: YOUR_API_KEY
Accept: application/json
```

Replace:

- `https://YOUR_API_DOMAIN` with the base URL provided by the manager;
- `YOUR_API_KEY` with your API key.

Do not send the key:

- in URL parameters;
- in the body of a GET request;
- in a file name;
- in error messages;
- in public documentation or examples.

## cURL Example

You can use environment variables for local testing:

```bash
export SPORTAPI_BASE_URL='https://YOUR_API_DOMAIN'
export SPORTAPI_KEY='YOUR_API_KEY'

curl --request GET \
  --url "$SPORTAPI_BASE_URL/v1/menu/live/en" \
  --header "Package: $SPORTAPI_KEY"
```

Do not store an active key in the shell history of a shared computer.

## Storing the Key Securely

Store the API key in your application's protected configuration:

- an environment variable;
- hosting or CI/CD secrets;
- a secrets manager;
- server-side configuration that is not committed to the repository.

Do not hard-code an active key in the source code or commit a file containing the key
to Git.

If sports data is used on a public website, requests to Sport Line API should be made
through your backend. This prevents website visitors from seeing the personal key in
their browsers.

If the key is accidentally exposed, contact SportAPI support to have it replaced.

## Sport Restrictions

The key contains a list of available sports.

The supported sports and esports disciplines and their `sport_id` values are listed in
the [SportAPI Sports Reference](../reference/sports.md).

If a requested `sportId` is not included in the subscription, the API may deny access:

```json
{
  "error_code": 100,
  "error_message": "Access denied"
}
```

Methods that return multiple sports build their responses according to the client's
access. Sports that are not included in the subscription may be omitted from the
response.

## Language Restrictions

The complete list of available languages and their codes is provided in the
[Sport Line API Language Reference](../reference/languages.md).

The language code is included in the request path:

```text
/v1/menu/live/ru
/v1/menu/live/en
```

The requested language must:

1. be supported by Sport Line API;
2. be included in the client's subscription.

If the language exists but is not included in the key's subscription, the API returns:

```json
{
  "error_code": 100,
  "error_message": "The language is not available in your package."
}
```

If an unsupported language code is provided, the API may return:

```json
{
  "error_code": 100,
  "error_message": "Invalid language"
}
```

Contact the SportAPI manager for the exact list of languages available to your key.

## Key Status and Expiration

Access remains available while the key:

- exists in the system;
- has an active status;
- has not reached its expiration date;
- provides access to the requested data.

If the access period has ended or the key has been disabled, the API returns:

```json
{
  "error_code": 100,
  "error_message": "Package has expired"
}
```

Contact the SportAPI manager to renew access. Do not create a new key yourself or use
another client's key.

## Authentication Errors

Access errors are returned as JSON with `error_code` and `error_message` fields:

```json
{
  "error_code": 100,
  "error_message": "Invalid Package"
}
```

When processing a response, check for `error_code` and `error_message` instead of
relying only on the HTTP status.

All confirmed errors, their causes, and troubleshooting steps are documented in
[Error Handling](error-handling.md).

## Verifying the Connection

Before starting the main integration, verify that:

1. You are using the base URL provided by the manager.
2. The key is sent in the `Package` header.
3. The key is not written to logs or displayed in interface messages.
4. The `line` or `live` value is correctly specified in the URL.
5. The requested language is included in the subscription.
6. The requested sport is available to the key.
7. The access period has not expired.

Make the following request to verify the connection:

```bash
curl --request GET \
  --url 'https://YOUR_API_DOMAIN/v1/menu/live/en' \
  --header 'Package: YOUR_API_KEY'
```

## Support

If access does not work, send the manager:

- the request URL without the key;
- the time when the request was made;
- `error_code` and `error_message`;
- the language and sport ID used;
- the environment: local, test, or production.

Do not send the API key in a public chat or public issue.

- SportAPI support: [@suport_sportapi](https://t.me/suport_sportapi)
- Official website: [sportapi.net](https://sportapi.net)

Next: [Core Concepts](core-concepts.md).
