Partner API: Authentication
| Key | Use | Meet access |
|---|---|---|
ss_sk_ secret | Backend servers; keep in a secret store | All visible meets, or the key’s locked meets |
ss_pk_ publishable | Browser / OBS overlays | Meet-locked by default; unlocked access requires explicit admin approval |
Never put a secret key (ss_sk_) in a browser or OBS source.
Send keys over HTTPS in the header Authorization: Bearer YOUR_PARTNER_KEY. Use exactly Bearer and one space. Never put credentials in URLs: ?key=, ?api_key= and ?token= are rejected.
fetch('https://scorsync.com/index.php/api/partner/v1/ping', {
headers: { Authorization: 'Bearer YOUR_PUBLISHABLE_KEY', Accept: 'application/json' },
credentials: 'omit'
})Partner requests allow any origin without cookies. Publishable keys are visible to viewers; restrict scopes and meets, monitor usage and revoke abused keys.
Keys work only under /api/partner/v1. Login cookies, Sanctum tokens and meet ingest tokens do not authenticate partner requests. Revoked or expired keys stop working. Owner deletion revokes access; entitlement changes can take up to five minutes to apply.
Meet locks
A locked key can list and read only its allowed visible meets. Athlete search, show and stats require ?meet=ID_OR_SLUG, and the athlete must appear on a non-scratched start list in that meet (including the second synchro athlete). Otherwise the API returns meet_context_required, meet_not_allowed or not_found.
For eligible athletes, aggregate personal best, season best, average difficulty and national ranks are season-wide across visible meets. Only meet_rank uses the requested meet. Raw score and standings endpoints remain restricted to locked meets.