Documentation/Guides
Authentication | Baseball Data API
AuthenticationYour key, the two ways to send it, and rotating it.
Every account has one key, in the form bba_live_.... Send it on every call in either of two ways:
curl https://api.baseballapi.net/v1/leagues -H "X-API-Key: YOUR_KEY"
curl https://api.baseballapi.net/v1/leagues -H "Authorization: Bearer YOUR_KEY"
A key in the address (?key=) is refused with a 400, so it never lands in a log. A missing or inactive key gets unauthorized.
Rotating your key in your account gives you a new one at once; the old one keeps working for 24 hours, so a deploy is not broken mid-day. Your plan is read from your account on every call, so an upgrade counts straight away.