Skip to main content

Get an API key

An API key identifies the application, website or service accessing the E.A.E Golf API. Every request to a protected endpoint must include a valid key.

Native and server applications​

Native iOS and Android applications do not use browser CORS protection. API keys embedded in an application package can also be extracted.

Server-side integrations can protect API keys more effectively because the key remains on the server and is not delivered to users.

When registering a native or server application, specify the application type so suitable scopes and rate limits can be assigned.

Using the API key​

Send the key as a Bearer token in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Example:

curl 'https://api.eae.golf/v1/clubs?limit=20' \
  --header 'Authorization: Bearer YOUR_API_KEY'

Do not send API keys as query parameters.

Keep the key secure​

  • Do not commit keys to a public repository.
  • Do not include production keys in documentation or support requests.
  • Store server-side keys in environment variables or a secrets manager.
  • Use separate keys for development, staging and production.
  • Revoke and replace keys that may have been exposed.
  • Request only the permissions required by the application.

Activation and limits​

Once registration is approved, the API key is associated with its permissions, rate-limit tier and any applicable origin restrictions.

Requests using an invalid, revoked or missing key return 401 Unauthorized. A valid key without permission for an endpoint returns 403 Forbidden. Requests exceeding the assigned limit return 429 Too Many Requests.