Authorization

The Trading API uses OAuth 2.0 with the client credentials grant. You get a client_id and client_secret for your bookmaker (see Getting credentials), exchange them for a short-lived Bearer access token at the token endpoint, then send that token in every API request.

1. Request an access token

1
2
3

curl -u 'CLIENT_ID:CLIENT_SECRET' \
     -d grant_type=client_credentials \
     https://api.int.databet.cloud/oauth/token

1
2
3
4
5

{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6...",
  "token_type": "Bearer",
  "expires_in": 3600
}

1
2
3
4

curl -d grant_type=client_credentials \
     -d client_id=CLIENT_ID \
     -d client_secret=CLIENT_SECRET \
     https://api.int.databet.cloud/oauth/token

The token endpoint accepts an application/x-www-form-urlencoded body (not JSON). Send the credentials either via HTTP Basic authentication (recommended) or as client_id and client_secret form fields. Use one method, not both.

2. Call the API with the token

Send the token in the Authorization header on every request. It replaces the client certificate — no --cert / --key is needed.

1
2

curl -H 'Authorization: Bearer ACCESS_TOKEN' \
     https://feed.int.databet.cloud/all

1
2
3
4

curl -X POST https://mts.int.databet.cloud/bets/calculate \
     -H 'Authorization: Bearer ACCESS_TOKEN' \
     -H 'Content-Type: application/json' \
     -d @bet.json

Access tokens are short-lived (see expires_in, in seconds). When a token expires, request a new one — the client credentials grant has no refresh token. A common approach is to cache the token in memory and re-mint it shortly before it expires, or on the first 401.

3. Send requests from the docs

You can send requests to the API from any Trading API page. Click Authorize and enter your client_id and client_secret. The docs request an access token for you.

You can also request a token directly below.

Getting credentials

A client_id and client_secret pair belongs to an OAuth client. There are two ways to get one:

• Sport Trading Management — generate an OAuth client yourself:

  1. Go to Settings → OAuth clients.
  2. Click Generate new.
  3. Enter a label for the OAuth client, for example the name of the integration, and click Generate.
  4. Copy the Client ID and Secret from the dialog, then click Close.

  The dialog also shows a ready curl command that requests an access token with the new credentials. See OAuth clients for details.

• DATA.BET integration team — ask your integration manager to generate an OAuth client for you.

Rotating and revoking

A bookmaker can have several active OAuth clients, so you can rotate credentials without downtime:

1. Generate a new OAuth client.
2. Switch your integration to the new client_id and client_secret.
3. When all traffic uses the new OAuth client, click Revoke on the old one.

A revoked OAuth client cannot request new tokens. A token already issued to it, however, keeps working until it expires (see expires_in, up to 1 hour) — the gateway verifies tokens locally against the current signing key and does not check revocation status on every request. If you need a token to stop working immediately, treat it as compromised and contact the DATA.BET integration team.

Legacy: mTLS authentication (deprecated)

After registering, get in touch with the Trading platform's admin to receive the X.509 certificate. client.crt and client.key are provided by the DATA.BET integration team.

Check that the certificate works

To check the certificate, request the version of the latest patch/log via curl.

1
2
3
4
5

curl --request GET \
     --url https://feed.int.databet.cloud/logVersion \
     --cert    client.crt \
     --key     client.key \
     --verbose

1
2
3
4
5
6
7
8
9

< HTTP/1.1 200 OK
< Last-Version: 1znkQdjQYSW000004gfKZM
< Last-Version-Hex: 174213d5391edf1000000001000050b8
< Date: Thu, 09 Feb 2023 06:34:10 GMT
< Content-Length: 22
< Content-Type: text/plain; charset=utf-8
<
* Connection #0 to host 127.0.0.1 left intact
1znkQdjQYSW000004gfKZM