Connecting your website with the content API

Overview

The content API lets your own website pull the articles and pages you publish on the API channel. You authenticate with a single per-club API key. Manage it from Content in the sidebar, then the API key button.

Generating a key

1. On the API key screen, click Generate API key.
2. The full key is shown once — copy it now and store it somewhere safe. It starts with sck_.
3. After that, only a masked hint (sck_•••• and the last four characters) is shown. StatsCentral only ever stores a one-way hash of the key, so it can't show you the full key again.

If you lose the key, you don't recover it — you rotate to get a new one.

Using the key

Send the key in the X-Api-Key header. Two read-only endpoints return your published, API-channel content as JSON:

• /api/v1/content/articles
• /api/v1/content/pages

curl https://your-statscentral-host/api/v1/content/articles \
  -H "X-Api-Key: YOUR_API_KEY"

List responses include a summary of each item; the single-item endpoint (/articles/:slug) includes the full body.

Allowed origins (CORS)

If your website calls the API from the browser, add your site's origin(s) under Allowed origins — comma-separated, for example https://example.com, https://www.example.com. Leave it blank to allow any origin. Server-to-server calls (no browser origin) are always allowed.

Rotating and revoking

• Rotate — generates a fresh key and shows it once. The previous key stops working immediately, so update your website with the new one.
• Revoke — disables the key entirely. Your website loses access until you generate a new one.

Both actions ask you to confirm, because anything using the old key breaks the moment you do them.

Edge cases / gotchas

• Only API-channel published items are returned. Drafts, public-page-only items, and anything taken down are excluded.
• The key is a secret. Treat it like a password — don't commit it to a public repo or ship it in front-end code you don't control.
• Rate limits apply. Very high request volumes are throttled; cache responses on your side rather than calling on every page view.