Authentication

We authenticate against your platform using OAuth 2.0 client credentials. Your platform issues us a client ID and secret, which we exchange for a bearer token included on every data push to your endpoints.

Authentication endpoint

We send form-encoded POSTs to your auth service to obtain a token.

Request

POST https://auth.{partner-host}/oauth/token
Content-Type: application/x-www-form-urlencoded

Request parameters

Parameter	Type	Required	Description
grant_type	string	Yes	Must be "client_credentials"
client_id	string	Yes	Your OAuth client ID provided by the platform
client_secret	string	Yes	Your OAuth client secret provided by the platform
audience	string	Yes	Target API audience URL

Example request

curl

curl -X POST https://auth.{partner-host}/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "audience=https://api.partner.integration.odds-prod.{host}/"

Example response

Token response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400
}

Using the token

We include the access token in the Authorization header on every request to your odds and session endpoints.

Header

Authorization: Bearer {access_token}

Token refresh strategy

Recommended handling

Our service obtains tokens at startup (or on first need) using the client credentials flow.
The access token is cached and reused for all outbound calls until it is close to expiry.
A new token is fetched before expiration — we do not wait for 401s in steady state.
Your platform should expect a valid bearer token on every inbound request from our service.