Authentication - SportXAPI

SportXAPI authenticates API requests using an API key passed in the request headers.

API Key Header

Send your key in the X-API-Key HTTP header with each request:

X-API-Key: YOUR_API_KEY

Header	Required	Description
`X-API-Key`	Yes (Paid)	Your secret SportXAPI token generated from the dashboard.
`Accept`	No	Recommended: `application/json`.

Header Example

curl -X GET "https://apiv2.sportxapi.com/cricket/api/v2/match/featured" \
  -H "X-API-Key: sx_live_1234567890abcdef" \
  -H "Accept: application/json"

Security Best Practices

Never commit your API key to client-side code, public GitHub repositories, or browser-accessible scripts.

Keep Keys Server-Side: Make requests from backend servers, serverless functions, or reverse proxies.
Environment Variables: Store keys in environment variables (e.g. SPORTXAPI_KEY) rather than hardcoding.
Key Rotation: If a key is accidentally exposed, immediately revoke it from the Dashboard and generate a replacement.