Authentication

Every request carries a bearer token. Keys are scoped, rotatable and can be restricted to specific origins.

Bearer tokens

Pass your key in the Authorization header. TCGGraph does not accept keys as query parameters, because query strings end up in logs, referrer headers and browser history.

curl "https://api.tcggraph.com/v1/games" \
  -H "Authorization: Bearer $TCGGRAPH_KEY"

Key types

Two prefixes, two threat models.

tcg_live_… — a secret key. Full read access to your plan. Server-side only. If one leaks, rotate it immediately.
tcg_pub_… — a publishable key. Safe to ship in a browser or mobile bundle. It is read-only, cannot list your account, and is locked to the origins you allow-list.

Origin restrictions

Publishable keys reject requests whose Origin header is not on the allow-list, which stops a scraped key from being used against your quota from somewhere else. Add origins in the dashboard; wildcards are supported for subdomains.

Rotation

Create a second key, deploy it, then revoke the first. Both keys stay valid during the overlap, so rotation never needs a maintenance window. Revocation takes effect at the edge within about ten seconds.

Authentication errors

Status	Code	Cause
401	unauthenticated	Header missing, malformed or the key was revoked.
403	forbidden	Valid key, but the origin is not allow-listed or the plan excludes the resource.

See Errors for the full list and the shape of an error body.