Authentication and API keys

Send your key

Add the header to every request. Keys in the query string are not accepted.

curl -s 'https://api.thepredictionmarkets.com/api/public/v1/rate-limit' \
  -H 'X-API-Key: tpm_demo_key_authorized_2026'

Calling /rate-limit is a cheap way to check a key works: it returns your plan and usage and is not counted as a data request.

Create a key

1. Sign in, then open API keys.
2. Click Generate Key and give it a name you will recognise, e.g. Production server.
3. Copy the key when it appears and store it somewhere safe, such as an environment variable or a secrets manager.

Each account has one free key. To replace it, revoke the old one first; that frees the slot.

Revoke or rotate a key

1. On API keys, click Revoke next to the key.
2. Apps using it start getting 401 auth.invalid_key within a minute.
3. Generate a new key and update your apps.

The demo key

tpm_demo_key_authorized_2026 is public. It works on every REST endpoint, so you can try the API and the Try it panels in these docs.

• One shared bucket of 5 requests per second for everyone using it, so you may see 429 errors.
• It cannot open the WebSocket. Create a free key for streaming.
• Do not build anything real on it. It can be limited or rotated at any time.

Keep your key secret

• Call the API from your server, not from public browser or mobile code where anyone can read the key.
• Do not commit keys to Git. Read them from the environment.
• If a key leaks, revoke it and generate a new one.

Authentication errors

{
  "error": {
    "code": "auth.missing_key",
    "message": "Send your API key in the X-API-Key header.",
    "request_id": "0f8969a6-0968-4d7c-9cbb-de379e8c19c4"
  }
}