Authentication & API keys

Every request is authenticated with an API key that starts with ps_live_.

Sending the key#

curl -H "x-api-key: $PINNSOCKET_KEY" https://pinnfeed.io/v1/account

// Browsers cannot set headers on WebSocket: use the query string
const ws = new WebSocket(`wss://pinnfeed.io/v1/stream?key=${key}`);

Avoid putting keys in front-end code that ships to users. Proxy through your own backend instead.

Multiple keys#

You can create up to 20 active keys per account from the dashboard — one per project, server or friend. Each key can be renamed and revoked independently and has its own usage counters.

Plan limits (connections, rate limits, sports) apply per account, across all of its keys.

Revoking a key#

Revoking takes effect within seconds: REST calls return 401 invalid_key and open WebSocket connections using that key are closed with code 4001.

Security#

• Keys are stored as SHA-256 hashes; we cannot show you a key again. If you lose one, revoke it and create a new one.
• Rotate keys when a team member leaves or a key may have leaked.
• Use HTTPS/WSS only. Plain HTTP is redirected.

Checking your key#

curl -H "x-api-key: $PINNSOCKET_KEY" https://pinnfeed.io/v1/account

{
  "plan": "builder",
  "key": { "id": 42, "name": "prod-bot" },
  "limits": { "ratePerSec": 10, "perDay": null, "wsConnections": 3, "sports": [1,2,3,4,5,6,7,8,9,10,11,12,13], "delayedSeconds": 0, "mainMarketsOnly": false, "history": true },
  "usage": { "restRequestsToday": 1834 }
}