API Authentication and Access

To use our APIs, you must first be granted access through our support team. This process ensures proper authentication and usage tracking.

Fixture and bot customer endpoints are documented in Fixture Management API.

1. Request access

Contact our support team to request API access. Once approved, we create a Machine-to-Machine (M2M) Auth0 Client for you.

You will be provided with:

  • clientId
  • clientSecret
  • audience
  • access token url

These values are required to obtain a valid OAuth 2.0 access token from Auth0.

Production defaults (unless support gives different values):

Field Value
Access token URL https://sportzcast.eu.auth0.com/oauth/token
Audience https://servicehub.sportzcast.net/ (trailing slash required)
Auth0 tenant sportzcast.eu.auth0.com
Application type Machine to Machine

The M2M application must be authorized against the Auth0 API whose Identifier is https://servicehub.sportzcast.net/.

Do not use password grant or authorization-code grant for scripts — those grants are for interactive login and will fail with access_denied / Unauthorized.

2. Getting an access token

Use the client credentials grant against the Auth0 token endpoint.

Request

POST https://sportzcast.eu.auth0.com/oauth/token
Content-Type: application/json

{
  "client_id": "<clientId>",
  "client_secret": "<clientSecret>",
  "audience": "https://servicehub.sportzcast.net/",
  "grant_type": "client_credentials"
}

curl

curl -s -X POST 'https://sportzcast.eu.auth0.com/oauth/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "<clientId>",
    "client_secret": "<clientSecret>",
    "audience": "https://servicehub.sportzcast.net/",
    "grant_type": "client_credentials"
  }'

The response includes access_token. Use it as Bearer on every API call.

3. Required headers for all API requests

Every API request must include the following headers:

Header Description
Authorization Bearer \<access_token> – The access token obtained via Auth0.
X-Username The email / username you use to log in to our platform.
X-Token Sportzcast User Access Token from Account / UserInfo

Production API base URL: https://servicehub.sportzcast.net

4. Access token example

Below is an example in C# that demonstrates how to obtain an access token using the Auth0 Machine-to-Machine (M2M) credentials provided to you.

private static async Task<string> GetAccessToken()
{
    var client = new HttpClient();
    var requestBody = new
    {
        client_id = "clientId",
        client_secret = "clientSecret",
        audience = "https://servicehub.sportzcast.net/",
        grant_type = "client_credentials"
    };

    var json = JsonConvert.SerializeObject(requestBody);
    var content = new StringContent(json, Encoding.UTF8, "application/json");

    var response = await client.PostAsync("https://sportzcast.eu.auth0.com/oauth/token", content);

    if (response.IsSuccessStatusCode)
    {
        var responseBody = await response.Content.ReadAsStringAsync();
        var tokenData = JsonConvert.DeserializeObject<Dictionary<string, string>>(responseBody);
        return tokenData!["access_token"];
    }
    return string.Empty;
}

5. Adding the access token and headers to your requests

The following example shows how to include the access token, along with the X-Username and X-Token headers, in your API request.

private async Task CallApi()
{
    var httpClient = new HttpClient();
    var token = await GetAccessToken();
    httpClient.DefaultRequestHeaders.Authorization =
        new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
    httpClient.DefaultRequestHeaders.Add("X-Username", "username");
    httpClient.DefaultRequestHeaders.Add("X-Token", "token");

    // Call the endpoint with httpClient, e.g.
    // GET https://servicehub.sportzcast.net/external/fixture/by-genius-venue/{id}
}

6. Common Auth0 errors

Symptom Likely cause
access_denied / Unauthorized M2M app not authorized for the ServiceHub API, or wrong audience
unauthorized_client Application is not Machine-to-Machine
invalid_client Wrong client id/secret, or wrong Auth0 tenant

Other common issues:

  • Invalid/expired bearer token
  • Missing X-Username or X-Token
  • User token not active
  • Access not enabled for your account, feature, or target bots