Skip to main content
TournaChess

Developer Access

API keys are available for development, preview, and testing environments only. Bearer API-key access remains disabled in production, and the API settings tab is hidden there. Creating a key does not enable a production integration.

Create a key

  1. Open Settings, then the API tab and Developer Access card.
  2. Choose Create API Key and enter a description.
  3. Select an access level:
    • Read only permits GET requests to read data your account can access. It cannot manage API keys, run GET actions that change account data, or obtain reusable credentials.
    • Read and write permits reading and writing within your account's existing permissions. This is the default, including for existing keys.
  4. Optionally set an expiration date. Expired keys cannot authenticate.
  5. Create the key, copy it, and store it securely. The full secret is shown only once; TournaChess stores a one-way hash.

Use the key in the Authorization: Bearer <your-key> header only in a supported nonproduction environment. A key does not grant new club roles or bypass account restrictions. Disabled accounts cannot use their keys. Browser sessions take precedence when a request also carries a key.

Review usage and revoke access

The list shows each key's access level, masked identifier, authenticated request count, last-used date, and expiration. Counts reflect accepted authentications, not necessarily successful endpoint operations; some public read paths deliberately omit persistent usage tracking. TournaChess keeps aggregate statistics, not an unlimited request-history log.

Each key is limited to 120 accepted authentications per minute per server instance. The limit is in memory, so it resets on restart and is not a global quota across instances. Requests exceeding the budget fail authentication (401); wait a minute before retrying. Browser sessions do not use this budget.

Choose the delete button beside a key to revoke it. Applications using that key will no longer authenticate. You may have up to 25 active keys. Guest tournament directors cannot create or delete keys.

Existing keys keep their original bearer credentials, expiration, and read/write access when their stored values are migrated to hashes. To change a key's access level, create a replacement and delete the old one.

Last updated