> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.datafortennis.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.datafortennis.com/_mcp/server. # Authentication and request limits Authenticated beta access uses `Authorization: Bearer ` at `https://api.datafortennis.com`. Credentials are bound to a principal and current capabilities. Access to a release does not imply access to every research, enrichment or export operation. Revocation and current entitlements are checked on requests and durable replays. Keys belong in protected runtime files or your secret manager. Never send them to support transcripts, browser analytics, public API explorers or source control. Rotate through the operator's credential workflow; possession of an old cursor or export ID does not override revoked access. Manage your account at [console.datafortennis.com](https://console.datafortennis.com). Existing main-site login and console links redirect there; an older website session may require signing in again. API credentials and account records are unchanged. ## Subscription access When self-service subscription access is enabled, website sessions, API keys and prepaid subscription periods have separate lifecycles. A website login or a generated key does not by itself grant data access. The console shows access as ready after the API acknowledges the funded period. Checkout availability depends on the configured catalogue and payment provider; this guide does not imply that live payments are enabled. Request allowance, RPS and active concurrency are shared by the customer across keys and server processes. Rotation keeps the same usage. The current plan controls data capabilities; a paid future plan does not enable features early. An expired period, revoked access or stale control lease denies data requests. A security reset revokes keys; use a fresh website login and create new keys after recovery. Copy a generated key once into your secret manager. The console cannot reveal it again. It keeps key metadata and real request usage, without storing the secret in browser local or session storage. ## Bounded reads Ordinary list requests accept at most 100 rows per page. The current private credential budget also bounds aggregate response rows to 100 and JSON bytes to 128 KiB. An endpoint's maximum is a ceiling, not a promised entitlement. Batch point reads accept at most 20 match IDs; the response budget applies to the whole response, not independently to each match. Request size, deadlines, active concurrency and durable principal request quotas are enforced independently. A 429 response requires bounded backoff. Repeated parallel retries increase transport usage even if one logical result is replayed. ## Channels Private Bearer and RapidAPI use the same application contract. The RapidAPI adapter is prepared, but no live listing is claimed. The provider proxy secret is different from the customer's RapidAPI key. Only the trusted channel boundary may convert verified external identity and plan into a principal. The local gateway additionally requires a lab client TLS certificate. This network credential does not replace application authorization.