Authentication

Every request except the health check must carry an API key. This page explains where keys come from, the exact header format and the security practices we recommend for server-side use.

All business endpoints use header-based API key authentication. Missing or invalid keys typically return 401 or 403 responses.

Required Header

bash

Authorization: YOUR_API_KEY

Node.js Example

javascript

const res = await fetch("https://openapi.scdata.cc/api/v1/youtube/user/info?channel_id=UC_x5XG1OV2P6uZZ5FSM9Ttw", {
  headers: {
    Authorization: process.env.SCRUMBALL_API_KEY,
  },
});
const data = await res.json();

Security Notes

Do not expose API keys in client-side code or public repositories.
Separate keys by environment such as dev, staging, and production.
If a key may be compromised, revoke it in the dashboard and create a new one immediately.