Authentication

Write endpoints and the Track API authenticate with an API key sent as a Bearer token.

Authorization: Bearer olap_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

How keys work

• Club-scoped. A key belongs to one club or track. It can only act on that club’s events and data. Using it on another club’s event returns 403.
• Shown once. The full key is displayed when you create it. Outlap stores only a SHA-256 hash and the first eight characters (the prefix) so you can recognise it in the list. Lose it and you must mint a new one.
• Revocable. Revoking a key in the app takes effect immediately; revoked keys return 401.
• Tracked. Each key records when it was last used.

Create and revoke keys in the app under Club → Settings → API keys. Step-by-step instructions are in Create an API key. Admin tooling can also mint keys through the API keys endpoint.

Scopes

Each key carries a list of scopes. New keys get both by default.

Scope	Grants
timing:write	Ingest laps, penalties, RMonitor streams and feed heartbeats; change session status.
timing:read	Reserved for reading non-public timing data. Public reads (leaderboard, laps, feed for public events) need no key.

A write endpoint called with a key that lacks timing:write returns:

{
  "error": "insufficient scope",
  "required_scope": "timing:write",
  "granted_scopes": ["timing:read"]
}

Which endpoints need a key

Endpoint group	Auth	Scope
Live Timing: ingest laps, stream, penalties, session status, feed status	Bearer key	timing:write
Live Timing: leaderboard, list laps, get feed	None (public events only)	n/a
Track API: summary, events, entries, payouts, calendar	Bearer key, or ?key= on calendar.ics	any valid key
Track API: public calendar	None	n/a
API keys: create	Outlap user session (JWT), not an API key	club admin

Authenticating calendar clients

Google Calendar, Apple Calendar and similar clients can’t send an Authorization header. The Track API therefore also accepts the key as a key query parameter, so a private feed can be subscribed to:

https://fzfstcyowovukscxgdrh.supabase.co/functions/v1/track-api/v1/calendar.ics?key=olap_xxxxxxxx

If you just want your public dates in a calendar, use the public calendar instead, which needs no key.

Errors you may see

Status	error	Cause
401	missing bearer token	No Authorization: Bearer … header.
401	invalid api key	Unknown, malformed or revoked key.
403	event does not belong to api key's club	The event belongs to a different club.
403	insufficient scope	The key lacks the scope the endpoint needs.

See Errors for the full list.