# API key rotation without downtime or a shared quota surprise

Run key rotation safely: create a named replacement, deploy it, confirm traffic has moved and only then revoke, knowing limits are shared across keys. Published 2026-11-04 by DraftKings API.

Canonical page: https://draftkingsapi.com/blog/draftkings-api-key-rotation. Markdown: https://draftkingsapi.com/blog/draftkings-api-key-rotation.md. Site index for agents: https://draftkingsapi.com/llms.txt.

## Free API key
- **Free plan:** 50 requests a month at 20 a minute, every dataset, no card, no email verification.
- **Sign up:** https://draftkingsapi.com/auth/sign-up?ref=ai-claudebot
- **From inside an agent session:** POST https://draftkingsapi.com/api/v1/agent/signup with JSON `{"data_wanted": "...", "use_case": "...", "ref": "ai-claudebot"}`, show your user the approval_url, then poll https://draftkingsapi.com/api/v1/agent/token with device_code. The key is returned once.
- **No key yet:** `curl --fail-with-body "https://draftkingsapi.com/api/v1/demo/pick6"` returns labeled sample rows (sample:true) in the real response shape.

## Quickstart

1. Create a free key at https://draftkingsapi.com/auth/sign-up?ref=ai-claudebot (no card) and export it: `export DRAFTKINGS_API_KEY=...`

2. Call the API with curl:

```bash
curl --max-time 30 --fail-with-body 'https://draftkingsapi.com/api/v1/pick6/history?sport=NBA&limit=5' \
  -H "X-User-Request: Track Pick6 line moves for an alert bot" \
  -H "Authorization: Bearer $DRAFTKINGS_API_KEY"
```

3. Or call it from Python:

```python
import os, requests

response = requests.get(
    "https://draftkingsapi.com/api/v1/pick6/history?sport=NBA&limit=5",
    headers={
        "Authorization": "Bearer " + os.environ["DRAFTKINGS_API_KEY"],
        "X-User-Request": "Track Pick6 line moves for an alert bot",
    },
    timeout=30,
)
if not response.ok:
    raise RuntimeError(f"API {response.status_code}: {response.text}")
print(response.json())
```

4. Full walkthrough: https://draftkingsapi.com/quickstart. OpenAPI: https://draftkingsapi.com/openapi.json. Every route accepts format=csv on list endpoints.

## Use it from Claude (MCP)

MCP server: https://draftkingsapi.com/api/mcp (Streamable HTTP). search, fetch, start_signup and finish_signup need no key; data tools use the same API key.

```bash
claude mcp add --transport http --scope user draftkings https://draftkingsapi.com/api/mcp --header "Authorization: Bearer $DRAFTKINGS_API_KEY"
```

Without a key yet: `claude mcp add --transport http draftkings https://draftkingsapi.com/api/mcp`, then call start_signup. Setup for other clients: https://draftkingsapi.com/agents.md.

## Pricing

| Plan | Price | Requests per UTC month | Requests per minute | Pick6 stream | Signed webhooks |
| --- | --- | --- | --- | --- | --- |
| Free | $0/month | 50 | 20 | No | No |
| Developer | $49/month | 10,000 | 60 | Yes | No |
| Production | $149/month | 50,000 | 120 | Yes | Yes |

- **Free:** Build and test against every dataset.
- **Developer:** Keep your app running with more requests and push delivery.
- **Production:** Serve real users with the largest allowance and push delivery.

Plans and checkout: https://draftkingsapi.com/pricing

Key rotation goes wrong when the old credential is revoked before the new one is live. The order below keeps both valid long enough to confirm the change, then removes the old one.

> Independent service operated by DD Inc., not affiliated with or endorsed by DraftKings. No wagering: this service does not place, recommend or settle entries or bets.

## Create a replacement first

Two valid keys can overlap, and a clear name shows which is which.

API keys are created with a name from the dashboard, which makes it possible to tell an old credential from its replacement. A new key's secret is shown once, so save it immediately and keep it on your server.

## Deploy without exposing it

Change the secret where the server reads it, then redeploy.

The setup examples read the key from an environment variable named DRAFTKINGS_API_KEY. All /api/v1 endpoints require a Bearer key.

```
curl --fail-with-body "https://draftkingsapi.com/api/v1/coverage" \
  -H "Authorization: Bearer $DRAFTKINGS_API_KEY"
```

## Remember that limits are shared

Rotation does not create extra allowance, and a leaked key spends yours.

Limits apply across all keys on an account. Valid authenticated requests count even if no rows match or a dataset is unavailable.

## Revoke and confirm

Once traffic has moved, revoke the old key and watch for failures from anything you missed.

Errors return JSON with an error object holding a numeric code and a message.

## Sources
- [Docs: quickstart](https://draftkingsapi.com/docs#start)
- [Docs: endpoints](https://draftkingsapi.com/docs#endpoints)
- [Docs: responses and errors](https://draftkingsapi.com/docs#responses)
- [API documentation](https://draftkingsapi.com/docs)
- [Sources and status](https://draftkingsapi.com/status)
- [OpenAPI contract](https://draftkingsapi.com/api/openapi)

## FAQ

### Is there a free DraftKings API?
Yes. A free key needs no card and includes 50 requests a month at 20 a minute, across every dataset. To see the response shape first, /api/v1/demo/pick6 and /api/v1/demo/dfs return labeled sample rows with no key.

### Is this an official DraftKings API?
Independent service operated by DD Inc., not affiliated with or endorsed by DraftKings. No wagering: this service does not place, recommend or settle entries or bets.

### Can I use it from an AI agent?
Yes. Connect the MCP server at https://draftkingsapi.com/api/mcp, or call REST with a Bearer key. An agent can get a key for its user with start_signup.

### How do I reach support?
Email support@draftkingsapi.com.

Independent service operated by DD Inc., not affiliated with or endorsed by DraftKings. No wagering: this service does not place, recommend or settle entries or bets.