Authentication

Every call carries your key in a header. There are two ways to send it, and both work on every endpoint and on the MCP server.

1. Authorization: Bearer

The usual way, and the one most HTTP clients and SDK generators expect:

curl https://api.rugbyapi.com/v1/results \
  -H "Authorization: Bearer rug_live_7f3c1a9e2b64d08c51e7a3f9d2b6c418"

2. X-API-Key

For a client or tool that cannot set an Authorization header, send the same key on its own:

curl https://api.rugbyapi.com/v1/results \
  -H "X-API-Key: rug_live_7f3c1a9e2b64d08c51e7a3f9d2b6c418"

The same two ways in code:

import requests
r = requests.get("https://api.rugbyapi.com/v1/results", headers={"X-API-Key": "rug_live_..."})

const r = await fetch('https://api.rugbyapi.com/v1/results', { headers: { Authorization: 'Bearer rug_live_...' } });

Never in the address

A key in the address (?key=, ?api_key=) is refused with 400 key_in_address before anything else is read, because addresses end up in proxy logs, browser history and shared links. If a key was ever sent that way, rotate it.

Rotating a key

We keep only a fingerprint of your key, never the key itself. If it is lost or may have leaked, press Rotate on your account: a new key is shown and the old one stops working the same second, with 401 revoked_key. Keep keys on your server rather than in code you ship to browsers.

Your key in these docs

Whenever your account shows a key in full (when it is made, rotated or given), this browser keeps it, so every documentation page fills it into the examples and Run works without pasting. Change it or forget it from the key bar on any endpoint page.

When a key is refused

Status	Code	Meaning
400	key_in_address	The key was put in the address. Send it in a header.
401	missing_key	No key was sent in either header.
401	invalid_key	The key is not one of ours. Check for a missing character.
401	revoked_key	The key was rotated. Use the new one from your account.

Status is the one endpoint that needs no key, and the OpenAPI description is open too.