Authentication

Every Club API request requires two credentials:

• a Subscription Key, which identifies the authorized integration;
• a Club Token, which selects the club and grants either read-only or read-write access. The API reference calls this credential the Club API Key.

Send both credentials as request headers:

X-Sub-Key: <subscription-key>
Authorization: Bearer <club-api-key>

Subscription Key

The club profile’s Club API tab provides primary and secondary Subscription Keys. Either key can be sent in X-Sub-Key.

Use the two values to rotate a Subscription Key without downtime. Regenerating a key invalidates its previous value immediately; switch the integration to the other key before regenerating it. See Manage Club API access for the complete sequence.

Club Token (Club API Key)

The Club Token supplies the Bearer value identified as ClubApiKey in the OpenAPI contract. It selects the club on which the request operates. A club can have multiple tokens so that integrations can use independent secrets, permissions, and expiration dates.

Each Club Token grants one access level:

• Read for read-only operations;
• ReadWrite for both read and write operations.

Treat the token as an opaque secret: do not parse it or depend on its internal representation. Its expiration is selected when the token is created.

Create, rename, replace, and revoke Club Tokens from the club profile’s Club API tab. Read Manage Club API access for the self-service workflow and token-replacement guidance.

Store credentials safely

• Keep credentials in a server-side secret store or protected environment variables.
• Never embed them in browser or mobile applications.
• Never write them to application logs or monitoring events.
• Do not commit them to a repository.
• Make credential replacement possible without rebuilding the integration.

Authentication errors

An invalid Subscription Key returns 401 Unauthorized:

{
  "statusCode": 401,
  "message": "Access denied due to invalid subscription key. Make sure to provide a valid key for an active subscription."
}

A missing, expired, or invalid Club API Key also returns 401 Unauthorized. Retrying unchanged credentials will not succeed.

A valid Club API Key returns 403 Forbidden when its access level does not permit the operation or the selected club does not have an active Club API license.

A resource that does not exist, or does not belong to the selected club, returns 404 Not Found.

See Errors for all public status codes, structured conflict reasons, and retry guidance.

Continue with Making requests for headers, JSON bodies, query parameters, dates, and units.