Authentication

Every request to the Motorsport API must include a valid API token. This page covers how to generate a token and the two ways to attach it to a request.

Generate your API token

1. Log in to MySportmonks. If you do not have an account yet, create one at my.sportmonks.com/register.

2. Go to the API section in your dashboard.

3. Select Tokens from the dropdown.

4. Enter a name for your token, for example "Motorsport App".

5. Click Create.

Your token is generated instantly. Copy it and store it securely. For security reasons it will not be shown again in MySportmonks once you navigate away.

Your token has no expiration date and remains valid until you delete it.

Attach your token to a request

You can pass your token in one of two ways. Both count towards the same rate limit, and you can use either or both at the same time.

As a query parameter:

https://api.sportmonks.com/v3/motorsport/fixtures?api_token=YOUR_TOKEN

As an Authorization header:

Authorization: YOUR_TOKEN

const response = await fetch('https://api.sportmonks.com/v3/motorsport/fixtures', {
  headers: {
    'Authorization': 'YOUR_TOKEN',
    'Accept': 'application/json'
  }
});

$curl = curl_init();
curl_setopt_array($curl, array(
  CURLOPT_URL => 'https://api.sportmonks.com/v3/motorsport/fixtures',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => array(
    'Authorization: YOUR_TOKEN',
    'Accept: application/json'
  ),
));
$response = curl_exec($curl);
curl_close($curl);
echo $response;

Keep your token secure

Your token is tied to your subscription and determines which leagues, seasons, and data features you can access. Treat it like a password.

• Store it in an environment variable, never hardcode it in source files.

• Never expose it in client-side JavaScript, logs, or version control.

• If you are building a browser-based application, route requests through a backend or proxy server rather than calling the API directly from the frontend. Calling the API directly from a browser also runs into CORS restrictions, since the Sportmonks API does not set permissive CORS headers for arbitrary origins.

Common errors

401 Unauthorized. Cause: missing or invalid api_token. Fix: confirm the token is copied correctly and attached to every request, not just the first one in a session.

403 Forbidden. Cause: the token is valid but does not have access to the requested resource, usually because it belongs to a different subscription tier. Fix: check your plan in MySportmonks, or check the Endpoints page to confirm the endpoint is included in your tier.

FAQ

Do tokens expire? No. A token remains valid indefinitely until you delete it from MySportmonks.

Can I use the same token for the Football API and the Motorsport API? Yes. A Sportmonks API token authenticates you as a customer, not against a single product. Access to each product's endpoints depends on your subscription, not on having separate tokens.

What happens if I lose my token? You cannot retrieve a lost token. Generate a new one in MySportmonks and update your application. The old token continues to work until you manually delete it, so deactivate it if you suspect it was exposed.

Related

• Make your first request

• Getting Started