Authentication
The three headers, how the quota is counted, and what the whitelist checks.
POST /v1/post/fetch is authenticated. GET /v1/get/games is not.
Required headers
X-API-Token: YOUR_API_KEY
X-API-Token-Type: FREE
X-API-Token-Email: [email protected]Header names are case-insensitive. Values are not: the email is lowercased before lookup, but the token is compared exactly.
| Header | Rule | Failure |
|---|---|---|
X-API-Token | The key from your dashboard. | 401 API token is required |
X-API-Token-Type | FREE or PRO, matching the key's package. | 401 API token Type is required / is invalid |
X-API-Token-Email | The account email that owns the key. | 401 API token Email is required |
The type must match the key's actual package. A PRO key sent with
X-API-Token-Type: FREE is rejected as invalid credentials, not silently
downgraded. This is the most common cause of a 401 on a key that works
elsewhere.
All four of these must hold or the request returns
401 Invalid/Stopped API Credentials. Check token email/type (FREE or PRO).:
- the email and token belong to the same key,
- the package matches the declared type,
- the key is active,
- the owning account is not suspended.
Quota
Usage is counted per key over a rolling 24-hour window, not per calendar day. There is no midnight reset to wait for; capacity returns gradually as older requests age out.
- Default quota:
1440requests per 24 hours. PROkeys are not quota-checked.- Exceeding it returns
429with the numbers, so a client can show the real state:
{
"message": "Daily quota exceeded for this API key",
"quota": 1440,
"used": 1440
}Every authenticated request is logged for accounting, including the ones that
fail. Retrying a 401 in a loop consumes quota for nothing.
Whitelist
A key can be restricted, in which case a rejected request returns 403 with
Request origin is blocked by API key whitelist settings.
- IP whitelist: the request IP must equal the configured value. The IP is
taken from Cloudflare's own connecting-IP header, falling back to the proxy
chain. A client-supplied
X-Forwarded-Forcannot influence it. - Domain whitelist:
Origin,RefererorHostmust match the configured domain, or be a subdomain of it. A server-to-server call that sends none of those three headers is refused, so use an IP whitelist for backend traffic and a domain whitelist for browser traffic.
Leaving the whitelist empty disables the check even when it is switched on.
Client pattern
Build the headers in one place so every call, retry and log path stays consistent.
export function buildGameQueryHeaders() {
return {
'Content-Type': 'application/json',
'X-API-Token': process.env.GQ_API_TOKEN,
'X-API-Token-Type': process.env.GQ_API_TOKEN_TYPE,
'X-API-Token-Email': process.env.GQ_API_TOKEN_EMAIL,
};
}