Authentication
On this page
How to send the API key on every call
Every public API call needs one X-API-Key: mbc_live_your_key header. The API has no guest access: a missing, unknown, revoked, or rotated key returns 401 invalid_key.
X-API-Key: mbc_live_your_keycurl https://api.managebetcodes.app/v1/usage \
-H "X-API-Key: mbc_live_your_key"How to create a key and which plan it needs
Create an API key on the API dashboard as a signed-in user with a verified email. Name the key and set charge_order there: Free allows 1 key (with 5 lifetime action credits), Starter 2 keys, Pro 3, Tipster 5, Developer 5, Scale 20, and Business 50.
The full key shows one time. The server keeps no plaintext copy.
How to rotate, revoke, and rename a key
Manage key lifecycle on the API dashboard: rotate a key to keep the old key valid for 24 hours, revoke to stop a key at once, and rename or change charge_order at any time. The dashboard lists keys without ever showing plaintext, and keys must stay on a server or trusted runtime, never in browser code.
- Rotate a key on the dashboard. The old key stays valid for 24 hours.
- Revoke a key on the dashboard. The key stops at once.
- Rename a key or change
charge_orderon the dashboard. - The dashboard lists your keys. It never shows plaintext.
Which auth errors the API returns
The API returns 401 invalid_key for a missing, unknown, revoked, or expired-rotation key, 403 account_blocked for a banned account, and 403 plan_required for an action that requires a higher plan (such as async jobs without an API plan). All errors use the error envelope.
| HTTP | Code | When |
|---|---|---|
| 401 | invalid_key | The key is missing, unknown, revoked, or in the 24-hour rotation window after the old key expires. |
| 403 | account_blocked | The account is banned. |
| 403 | plan_required | The action requires an API plan (such as async jobs) or a missing entitlement. |
All errors use the error envelope.