API keys

An API key belongs to your SlingLab account. Create one in the console. SlingLab shows the full key once. After that the console lists only the prefix, and you can revoke the key there.

You can keep 5 active keys. Each key allows 60 requests a minute and 5,000 a day. Calls from one network address, including rejected keys, are limited to 120 a minute.

Send the key

Put the key in a header. Query strings are ignored, so the key does not land in an access log.

GET /slinglab/api/v1/decks HTTP/1.1
Host: slinglab.gg
X-API-Key: sk_live_your_prefix_your_secret

Authorization: Bearer sk_live_... works the same way. A key starts with sk_live_.

Choose scopes when you create the key. A key reads only your own account, never another player's.

Scope	Route	What it returns
`decks:public`	`GET /slinglab/api/v1/decks`	Decks other players have published. See Public decks.
`decks:read`	`GET /slinglab/api/v1/me/decks`	Every deck on your account, including private decks and decklists. See Your decks.
`analytics:read`	`GET /slinglab/api/v1/me/analytics`	Your career stats, deck performance, and the first page of recent games. See Analytics.

The public decks guide can run a request with one of your keys when you are signed in. OAuth is how an app asks a different player to connect, then calls the same your-decks and analytics routes with their access token.

Responses

A rejected key returns JSON:

{ "error": "missing or malformed api key", "code": "unauthorized" }

Status	`code`	When
401	`unauthorized`	The key is missing, malformed, unknown, or revoked.
403	`forbidden`	The key does not include the scope for that route.
429	`rate_limited`	The key is over its minute or daily limit. `Retry-After` says how long to wait.

Successful responses include X-RateLimit-Remaining and X-RateLimit-Daily-Remaining, and Cache-Control: no-store.