API Authentication & Security
US Lottery API authenticates all API requests using a custom HTTP header: x-api-key.
🔑 Header Specifications
Provide your API key in the request header as shown below. Every API key is unique to your developer account and tied to your plan quota.
Authenticated Request Snippets
# Always pass the x-api-key in the request header
curl -X GET "https://uslotteryapi.com/api/v1/draws/latest?game=powerball" \
-H "x-api-key: uslot_live_abc123xyz789..." \
-H "Accept: application/json"API Key Security Best Practices
✓ Server-Side Environment Variables
Always store your API keys in environment variables (e.g. process.env.US_LOTTERY_API_KEY) on secure backend servers.
✓ Use a Backend Proxy Route
If building single-page apps (React, Vue) or mobile apps, proxy API calls through your own backend to prevent exposing key credentials in client bundles.
✕ Never Commit Keys to Git
Add `.env` and `.env.local` to your `.gitignore` file to ensure API keys are never pushed to public code repositories.
⚡ Key Rotation
If you suspect an API key has been compromised, instantly revoke and re-generate your key in the Developer Dashboard.
401 Unauthorized Error Response
If the x-api-key header is missing, invalid, or expired, the API will respond with HTTP Status Code 401 Unauthorized:
{
"status": "error",
"code": 401,
"error_type": "UNAUTHORIZED",
"message": "Missing or invalid API key provided in 'x-api-key' header. Please check your token credentials.",
"timestamp": "2026-08-03T01:50:00Z"
}