Getting started
Authentication
Every request carries one API key in the x-api-key header. The key decides which games, live data and limits you get, so the same header works for every endpoint on your plan.
Send your key
Bash
curl "https://api.citoapi.com/api/v1/ufc/events/upcoming" \
-H "x-api-key: $CITO_API_KEY"Clients that only set an Authorization header can use a bearer token instead:
Bash
curl "https://api.citoapi.com/api/v1/ufc/events/upcoming" \
-H "Authorization: Bearer $CITO_API_KEY"The same call from code:
JavaScript
const res = await fetch("https://api.citoapi.com/api/v1/ufc/events/upcoming", {
headers: { "x-api-key": process.env.CITO_API_KEY },
});Python
res = requests.get(
"https://api.citoapi.com/api/v1/ufc/events/upcoming",
headers={"x-api-key": os.environ["CITO_API_KEY"]},
)Keys in the query string (?api_key=) are not accepted, so they never end up in logs or browser history.
Key types
- Account key
cito_followed by 64 characters. Create and revoke keys in the dashboard; they work immediately, with no activation step. Usage and limits follow your plan.- Demo key
pk_demo_cito_live_a06c129e0a9ce1c39c3035bd187541c4is public for trying the API: read-only, 50 requests a day per IP, every game's GET endpoints, no live streams or webhooks. The playground uses it.- AI connectors
- Claude, ChatGPT and Cursor can connect to the hosted MCP server by signing in, with no key to paste. The connection uses your account key's plan and stops when that key is revoked. See MCP.
Keep keys safe
Server-side onlyCall Cito from your backend, bot or script. A key in browser or app code can be copied by anyone.
Environment variablesKeep the key in CITO_API_KEY (.env, your host's secrets), never in source control.
One key per appCreate a separate key per project or environment so you can revoke one without touching the others.
Leaked? Revoke itRevoke the key in the dashboard and create a new one. Revoked keys stop working immediately.
Auth and access errors
| Status | error.code | What to do |
|---|---|---|
| 401 | MISSING_API_KEY | No key on the request. Add the x-api-key header. |
| 401 | INVALID_API_KEY | The key is malformed or doesn't exist. Copy it again from the dashboard. |
| 403 | API_KEY_REVOKED | The key was revoked. Create a new one. |
| 403 | GAME_NOT_INCLUDED | Your plan doesn't include this game. Add the game or upgrade. |
| 403 | LIVE_ACCESS_REQUIRED | Real-time live data needs a higher plan. |
| 403 | ODDS_ACCESS_REQUIRED | Odds endpoints need a plan that includes odds. |
| 405 | DEMO_KEY_READ_ONLY | The demo key can only make GET requests. |
| 429 | RATE_LIMIT_EXCEEDED | Too many requests this minute. Back off and retry. |
| 429 | MONTHLY_LIMIT_REACHED | This month's allowance is used. Upgrade or wait for the reset. |
A request with no key returns:
JSON
{
"success": false,
"error": {
"code": "MISSING_API_KEY",
"message": "API key is required. Include your key in the x-api-key header.",
"status": 401,
"docs": "https://citoapi.com/docs/authentication"
}
}