Get started

Authentication

Copy as Markdown

# Authentication

Send your API key in the Authorization header on every request.

```bash
curl 'https://api.opono.com/v1/fixtures' \
  --header "Authorization: Bearer $OPONO_API_KEY"
```

## Create a key

Create and revoke keys in [Developers](/developers) with an active Plus or Pro plan.

Free has no API access.

| Key prefix | Output | Cost |
| --- | --- | --- |
| `sk_test_` | Synthetic simulation; fixtures return an empty list. | Zero credits. |
| `sk_live_` | Real pre-match simulation. | Exactly draws / 1,000 credits per delivered simulation. |

## Set permissions

| Scope | Access |
| --- | --- |
| `data.read` | Read fixtures, free squads, and Opono Expected Lineup (one credit for both sides). |
| `simulations.run` | Submit, quote, and batch simulations; collect jobs. |
| `usage.read` | Read credits and usage. |

## Store and rotate keys

1. Store your key in a server environment variable such as OPONO_API_KEY.
2. Keep it out of browser code, URLs, logs, and public repositories.
3. If a key leaks, revoke it, create a replacement, and update your server.

See [Errors](/docs/errors) for 401 authentication failures and 403 permission failures.

Send your API key in the Authorization header on every request.

bash

curl 'https://api.opono.com/v1/fixtures' \
  --header "Authorization: Bearer $OPONO_API_KEY"

Create a key

Create and revoke keys in Developers with an active Plus or Pro plan.

Free has no API access.

Key prefix	Output	Cost
`sk_test_`	Synthetic simulation; fixtures return an empty list.	Zero credits.
`sk_live_`	Real pre-match simulation.	Exactly draws / 1,000 credits per delivered simulation.

Set permissions

Scope	Access
`data.read`	Read fixtures, free squads, and Opono Expected Lineup (one credit for both sides).
`simulations.run`	Submit, quote, and batch simulations; collect jobs.
`usage.read`	Read credits and usage.

Store and rotate keys

Store your key in a server environment variable such as OPONO_API_KEY.
Keep it out of browser code, URLs, logs, and public repositories.
If a key leaks, revoke it, create a replacement, and update your server.

See Errors for 401 authentication failures and 403 permission failures.