Getting started

Authentication

Every request must be authenticated with an API key sent in the Authorization header.

Base URL

All requests go to the versioned base URL:

text

https://api.zyron.pro/api/v1

API keys

Keys are prefixed with zyr_ so they are easy to recognize in logs and secret stores, for example zyr_xxxxxxxxxxxxxxxxxxxxxxxx.

Guild-scoped keys

Guild keys are created self-serve by server admins on the Zyron dashboard: go to www.zyron.pro, open your server, then Settings → API access. Each key is bound to exactly one guild — it can only call /guilds/:guildId endpoints for that guild.

The guild must be on the Premium or Pro plan. Without it, guild endpoints return 403 premium_required.
Guild keys are minted at the pro rate tier: 60 requests/minute and 2000/day. See Rate limits.
Guild keys also work for the Replay Parser.

Legacy keys

Older keys without a guild binding still work for the Replay Parser only. Calling guild endpoints with a legacy key returns 403 forbidden — create a guild-scoped key on the dashboard instead.

Authorization header

Send your key as a Bearer token on the Authorization header:

http

Authorization: Bearer zyr_xxxxxxxxxxxxxxxxxxxxxxxx

Alternatively, you may send the key on the X-API-Key header. Use one or the other — the Bearer header is recommended.

http

X-API-Key: zyr_xxxxxxxxxxxxxxxxxxxxxxxx

Authenticated request

bash

curl https://api.zyron.pro/api/v1/key \
  -H "Authorization: Bearer zyr_xxxxxxxxxxxxxxxxxxxxxxxx"

Keep your key secret

Treat keys like passwords. Anyone with your key can consume your rate limit.
Use keys from a trusted server environment. Do not embed a key in client-side JavaScript, a mobile app bundle, or a public repository.
Store keys in environment variables or a secrets manager, never in source control.

Unauthorized requests are rejected

A missing or invalid key returns 401 unauthorized. See the Errors page for the full list.