Api League Authentication

generated: '2026-09-02'
method: searched
source: openapi/api-league-art-openapi.yml, openapi/api-league-books-openapi.yml, openapi/api-league-food-openapi.yml,
  openapi/api-league-games-openapi.yml, openapi/api-league-humor-openapi.yml, openapi/api-league-knowledge-openapi.yml,
  openapi/api-league-math-openapi.yml, openapi/api-league-media-openapi.yml, openapi/api-league-news-openapi.yml,
  openapi/api-league-storage-openapi.yml, openapi/api-league-text-openapi.yml, openapi/api-league-web-openapi.yml
summary:
  types:
  - apiKey
  api_key_in:
  - header
  - query
schemes:
- name: apiKey
  type: apiKey
  in: query
  parameter: api-key
  sources:
  - openapi/api-league-art-openapi.yml
  - openapi/api-league-books-openapi.yml
  - openapi/api-league-food-openapi.yml
  - openapi/api-league-games-openapi.yml
  - openapi/api-league-humor-openapi.yml
  - openapi/api-league-knowledge-openapi.yml
  - openapi/api-league-math-openapi.yml
  - openapi/api-league-media-openapi.yml
  - openapi/api-league-news-openapi.yml
  - openapi/api-league-storage-openapi.yml
  - openapi/api-league-text-openapi.yml
  - openapi/api-league-web-openapi.yml
- name: headerApiKey
  type: apiKey
  in: header
  parameter: x-api-key
  sources:
  - openapi/api-league-art-openapi.yml
  - openapi/api-league-books-openapi.yml
  - openapi/api-league-food-openapi.yml
  - openapi/api-league-games-openapi.yml
  - openapi/api-league-humor-openapi.yml
  - openapi/api-league-knowledge-openapi.yml
  - openapi/api-league-math-openapi.yml
  - openapi/api-league-media-openapi.yml
  - openapi/api-league-news-openapi.yml
  - openapi/api-league-storage-openapi.yml
  - openapi/api-league-text-openapi.yml
  - openapi/api-league-web-openapi.yml
docs: https://apileague.com/docs/authentication/
provider: API League
providerId: api-league
description: 'API League authenticates with a single API key and nothing else. There is no OAuth, no OIDC,
  no scopes, no service accounts and no key rotation surface documented — one key grants the whole 55-operation
  surface, and the plan attached to that key is what varies. Two interchangeable apiKey schemes are declared
  in the OpenAPI and applied globally, and the provider documents both: `?api-key=YOUR-API-KEY` in the
  query string, or the `x-api-key` request header.

  The query-string form is the one the provider leads with in its own examples, and it is the weaker of
  the two — a key in a URL lands in proxy logs, browser history, referrer headers and shell history. An
  agent should use the x-api-key header. The terms of use place the consequences on the consumer: the
  key must be kept confidential, must be stripped before posting code to a forum or GitHub, and the account
  holder is responsible for any charges or harm from a compromised key.'
obtain:
  signup: https://apileague.com/console/
  free_tier: true
  card_required: false
  note: Keys are issued from the console after a free signup; the Free plan needs no payment method.
examples:
- style: query
  request: GET https://api.apileague.com/search-books?api-key=YOUR-API-KEY&query=romance
  source: https://apileague.com/docs/authentication/
- style: header
  request: 'GET https://api.apileague.com/search-books?query=romance

    x-api-key: YOUR-API-KEY'
  source: https://apileague.com/docs/authentication/
failure:
  status: 401
  body: '{"status":"failure","code":401,"message":"Please read https://apileague.com/docs/authentication"}'
  note: Returned for a missing or invalid key AND for every non-existent path on api.apileague.com — a
    401 on that host is not evidence a path exists.
gaps:
- No OAuth 2.0 / OIDC and no scopes — a key is all-or-nothing across all 55 operations.
- No documented key rotation, expiry, or per-key restriction (IP, referrer, endpoint).
- The provider's primary documented example puts the secret in the URL query string.
- No /.well-known/oauth-authorization-server or openid-configuration on any host (see well-known/api-league-well-known.yml).
evidence:
- url: https://apileague.com/docs/authentication/
  status: 200
- url: https://api.apileague.com/
  status: 401
- url: https://apileague.com/terms/
  status: 200
cross_links:
  conventions: conventions/api-league-conventions.yml
  errors: errors/api-league-problem-types.yml
maintainers:
- FN: Kin Lane
  email: info@apievangelist.com