The SportQuanta API uses workspace API tokens for authentication. Send your token as a bearer token in the Authorization header on authenticated requests. GET /v1/coverage/bookmakers is public and needs no token. Catalog endpoints require a token even though they are quota-free.

​
Getting a token

API tokens are issued per workspace from your SportQuanta dashboard. Each token is tied to one organization and counts against that organization’s monthly quota. Visit sportquanta.com to create one.
Treat your API token like a password. It carries your organization’s quota and billing. Never commit it to source control or embed it in client-side or mobile app code — proxy requests through your own backend instead.

​
The Authorization header

A complete header looks like:
Quota and rate limits accrue at the organization level, not per token. Rotating or adding tokens does not reset or multiply your limits.

​
Scopes

Public GET reads require the api.read scope. A token carrying only api.write does not authorize reads. If your token is valid but lacks the scope an endpoint requires, the API responds with 403 and the error code insufficient_scope. Contact your workspace admin or support@sportquanta.com to adjust a token’s scopes.

​
Failure modes

All auth failures use the standard error envelope:

​
Catalog, coverage, and plan access

Catalog endpoints — /v1/sports, /v1/leagues, /v1/bookmakers, and /v1/{league}/odds/markets and /props/markets — are authenticated but bypass monthly quota and hourly rate limits. /v1/coverage/bookmakers needs no token. Data routes separately check the organization’s odds, stats, or signals capability. Core, Sharp, and Max include odds and stats, including sharp-book prices. Max adds settlement signals; Sharp and Max include streaming. Active grants/trials can also supply capabilities. A valid token alone does not grant data access. See Rate Limits & Quota. Use /v1/public/token-info to inspect token label/scopes and /v1/public/tenant-info to inspect resolved organization/workspace context. These introspection routes run through the metered REST chain; they are not quota-free catalog reads.