Public developer docs
Public docs, authenticated managementAPI Keys
Personal developer keys let you test the v1 REST surface immediately from your own account without creating an OAuth client first.
Keys created here are account-owned bearer tokens. The raw secret is shown once at creation time, expires after 90 days, and carries the developer-key scope bundle defined on the server. In the current implementation that bundle includes every public resource scope except webhook writes.
Implementation notes
- Store the raw key immediately. Only the hashed token record is kept server-side.
- Revoking a key marks the connection and underlying access token records as revoked.
- Use personal keys for direct testing; use OAuth apps when third-party users need to approve access.
Endpoints
OpenAPIGET
/connectionCall any bearer-authenticated route with a personal key
The quickest smoke test is a connection lookup with the newly issued key.
- Developer keys are minted as bearer tokens directly, so no OAuth exchange step is required.
- The API key manager on this page handles create, list, copy, and revoke.
curl
curl https://your-domain.example/api/v1/connection \
-H "Authorization: Bearer osb_test_your_key_here"JavaScript
const baseURL = "https://your-domain.example/api/v1";
const apiKey = "osb_test_your_key_here";
async function api(path, init = {}) {
const response = await fetch(`${baseURL}${path}`, {
...init,
headers: {
"Authorization": `Bearer ${apiKey}`,
"Content-Type": "application/json",
"OpenScoreboard-Request-ID": "demo-request-001",
...(init.headers || {})
}
});
const body = await response.json();
if (!response.ok) {
throw new Error(body.error?.message || "Request failed");
}
return body.data;
}
const profile = await api("/connection");
console.log(profile.appName, profile.tokenExpiresOn);Loading developer keys
Checking your signed-in account and existing personal API keys.