Guide

Authentication

Bearer keys, trials, and what 401 vs 403 mean.

Sending the key

Send your key as a Bearer token. X-API-Key is accepted for clients that cannot set Authorization.

Either works

Authorization: Bearer tbi_live_YOUR_KEY
X-API-Key: tbi_live_YOUR_KEY

Keys are tied to your account, not to a key per environment — create up to 5 live keys with labels (prod, notebook) from /api/manage.

Plans and trials

Plan	Rate limit	Monthly quota	Max page size	Notes
trial	30 / min	2,000	1,000	One per account. 3 days from the moment you start it; keys pause after that and resume when you subscribe.
standard	120 / min	100,000	1,000	Billed monthly. Quota resets on the 1st (UTC).

Need more? Talk to us — higher limits are a setting, not a different API.

401 vs 403

401 unauthorized — no key, malformed key, or a key we don't recognize. Check the header.
403 forbidden — we know the key but it can't be used: it was revoked, the trial ended, payment is past due or the subscription was canceled. The message says which and links to /api/manage.

401

{
  "error": {
    "code": "unauthorized",
    "message": "missing API key — send `Authorization: Bearer tbi_live_…`"
  }
}

403 (trial ended)

{
  "error": {
    "code": "forbidden",
    "message": "your 3-day trial ended on 2026-10-16 — subscribe at https://www.thebettinginsider.com/api/manage to keep using this key"
  }
}

Rotating keys

Create the new key, deploy it, then revoke the old one. Revocation is immediate (the API's key cache is cleared on revoke) and permanent. Rate limits are per key, quotas are per account — splitting traffic across keys does not increase your quota.

Keep it server-side

Never ship a key in a browser bundle, mobile app or public notebook. Anyone holding it spends your quota. If a key leaks, revoke it from /api/manage — it stops working within a second.