Skip to main content

Authentication

The E.A.E Golf API uses API keys to authenticate requests. Send your API key as a Bearer token in the HTTP Authorization header:

Authorization: Bearer YOUR_API_KEY

Example request​

curl 'https://api.eae.golf/v1/clubs?limit=20' \
  --header 'Authorization: Bearer YOUR_API_KEY'

JavaScript example:

const response = await fetch(
  'https://api.eae.golf/v1/clubs?limit=20',
  {
    headers: {
      Authorization: `Bearer ${apiKey}`
    }
  }
);

if (!response.ok) {
  throw new Error(`API request failed with status ${response.status}`);
}

const result = await response.json();

API keys must not be sent as query parameters:

?api_key=YOUR_API_KEY

Query parameters may be stored in browser history, access logs, analytics systems and intermediary caches.

Protect your API key​

Treat API keys like passwords:

  • Do not commit keys to a public repository.
  • Do not include keys in publicly accessible source files.
  • Do not expose unrestricted production keys in client-side JavaScript.
  • Use separate keys for development, staging and production.
  • Revoke and replace a key if it may have been exposed.

Browser applications​

Code executed in a browser cannot securely conceal an API key because users can inspect the application source and network requests.

Browser keys should therefore have:

  • Read-only permissions
  • Appropriate request limits
  • Restrictions to registered origins
  • Access only to the endpoints required by the application

Origin restrictions provide an additional layer of protection for browser requests, but they do not make an exposed API key secret.

Native mobile applications​

API keys embedded in iOS or Android applications can also be extracted. Mobile applications should use restricted, replaceable keys with limited permissions and appropriate rate limits.

Applications requiring stronger protection should authenticate through their own backend or obtain short-lived access tokens.

Authentication errors​

The API returns:

  • 401 Unauthorized when the Authorization header is missing or the key is invalid
  • 403 Forbidden when the key is valid but does not have permission to access the requested endpoint
  • 429 Too Many Requests when the applicable rate limit has been exceeded

Never send your API key when requesting support, sharing logs or publishing code examples.