GET/api/v1/widget/app-keys
Live animation widget: App Keys with today's views and refusals
Description
An App Key (starts with pk_) is the public embed key for pages without a server of their own: it only loads the live animation widget, cannot call data endpoints and must have a domain allow-list. Embedding, parameters and refusal reasons are in the animation widget guide. These management endpoints are called with an API key; the console page "Live widget → App Key" uses the same ones.
Create / update: POST the same path with a JSON body: name (1 to 40 characters), config_id, domains (at least one, 20 at most, inside grant_domains), match_scope (all / live), daily_limit, max_concurrent, signed; add id to update. The answer to a create carries secret (the App Secret for signed mode), shown this once.
Actions: POST /api/v1/widget/app-keys/<id>/<action>, where action is disable, enable, rotate (new pk_ and App Secret, the old ones stop at once), secret (a new App Secret only) or delete.
An App Key disabled by the platform is view-only: enabling, updating, rotating, generating a new App Secret and deleting all return 403, and so does creating or updating another key for the same site (overlapping domains). Contact sales to have it restored.
Create / update: POST the same path with a JSON body: name (1 to 40 characters), config_id, domains (at least one, 20 at most, inside grant_domains), match_scope (all / live), daily_limit, max_concurrent, signed; add id to update. The answer to a create carries secret (the App Secret for signed mode), shown this once.
Actions: POST /api/v1/widget/app-keys/<id>/<action>, where action is disable, enable, rotate (new pk_ and App Secret, the old ones stop at once), secret (a new App Secret only) or delete.
An App Key disabled by the platform is view-only: enabling, updating, rotating, generating a new App Secret and deleting all return 403, and so does creating or updating another key for the same site (overlapping domains). Contact sales to have it restored.
Access
- Request
GET https://api.sports.csap.ai/api/v1/widget/app-keys- Auth
- Header X-API-Key: <your key> (Authorization: Bearer <key> also works; ?key= is still accepted but discouraged, because the key ends up in URLs and logs)
- External keys
- Requires entitlementThe endpoint and its data domain must be granted to the key; otherwise 403.
- Rate limits
- 3000 per minute · 200000 per day · Set per key (rate_per_min and quota_daily returned by /api/v1/account are authoritative; the numbers above are a trial key's). Beyond them the answer is 429. In addition, heavy requests such as whole-table snapshots and statistics lists without a match id are processed 2 at a time for the whole platform; a request that cannot get a slot receives 429 with Retry-After. Responses do not carry X-RateLimit-* headers for now. See the general guide
Request parameters 0
This endpoint takes no request parameters.
Example request
curl "https://api.sports.csap.ai/api/v1/widget/app-keys" \ -H "X-API-Key: YOUR_API_KEY"
Try it
Example response
{
"code": 0,
"data": {
"grant_domains": [
"example.com",
"*.example.com"
],
"keys": [
{
"config_id": "wgt_1cc93950",
"config_name": "比赛页 2.5D",
"created_at": "2026-11-09T23:02:44.525587-08:00",
"created_by": "api",
"daily_limit": 50000,
"denied": {
"concurrent": 0,
"config": 0,
"disabled": 0,
"domain": 0,
"quota": 0,
"rate": 0,
"scope": 0,
"signature": 0
},
"denied_today": 0,
"disabled_at": null,
"disabled_by": "",
"domains": [
"www.example.com",
"*.example.com"
],
"enabled": true,
"id": "wak_de1ac32c",
"key": "pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"match_scope": "all",
"max_concurrent": 5,
"name": "官网比赛页",
"online": 0,
"organization_id": 1,
"organization_name": "Example Co",
"signed": false,
"updated_at": "2026-11-10T00:43:01.628914-08:00",
"view": "2.5d",
"views_7d": 0,
"views_today": 0
}
]
},
"message": "success",
"success": true
}Response fields 2
grant_domainsarrayWidget domains the platform enabled for this organization (an App Key's domain allow-list must stay inside them)
keysarray<object>App Key list· 24
Errors
| HTTP | message | When |
|---|---|---|
| 401 | missing API key / unauthorized | No X-API-Key, or the key is invalid or disabled |
| 403 | The live animation widget isn't enabled. Please contact sales. | The organization has no access to the live animation widget, or the access is suspended |
| 400 | The name must be 1–40 characters. / Enter at least one domain allowed to embed the widget. / Invalid domain: … | The body of a create or update request does not meet the requirements |
| 400 | The domain … isn't among the widget domains the platform enabled for you. | A domain on the allow-list is not inside grant_domains |
| 403 | This App Key was disabled by the platform. Please contact sales. | Enabling, updating, rotating, generating a new App Secret for, or deleting an App Key that the platform disabled |
| 403 | The domain … belongs to an App Key the platform disabled. Please contact sales. | A domain of the key being created or updated overlaps with a key the platform disabled |
| 404 | Configuration not found. / App Key not found. | Wrong config_id or App Key id, or it does not belong to this organization |
| 409 | The platform hasn't set up widget domains for your organization yet. Please contact sales. | No embed domains are registered in the organization's widget access yet |
| 429 | rate limit exceeded / daily quota exceeded | The key's per-minute rate or daily quota is exceeded |
| 429 | server busy, retry later | The server's concurrency slots are full (only 2 heavy requests at a time); retry after Retry-After seconds |
| 500 | query error | The query failed on the server; you may retry |