DraftKings API quickstart: your first call in one minute

Who this is for

Developers and coding agents evaluating this API who want a response before reading anything else. Three steps: a sample with no key, a free key, then your own authenticated call. Operated by DD Inc., an independent service not affiliated with or endorsed by DraftKings.

Not for

A first call shows the shape. It does not settle fit.

• Deciding whether this API fits. Read which DraftKings you mean first if you are unsure.
• Sportsbook player props. See the sportsbook decision page.
• Production hardening. Read errors and rate limits and freshness before you ship.
• Browser code. Your key stays on a server, and only the keyless sample is safe to call from a browser.

Step 1: call the sample, no key

/api/v1/demo/pick6 and /api/v1/demo/dfs need no key and spend no quota. They return invented rows labeled sample: true in the real response shape, from a static fixture. They are the fastest way to wire up your parser, and they are not data.

curl --fail-with-body "https://draftkingsapi.com/api/v1/demo/pick6"

curl --fail-with-body "https://draftkingsapi.com/api/v1/demo/dfs"

Look at the demo object, the sample: true label on each row, then the fields you plan to read. The Pick6 sample has a one-sided row, a paused row and a stale row, and the DFS sample has one athlete in two roster slots.

Step 2: create a free key

Create an account, open the dashboard and create a named API key. The Free plan includes 500 requests per UTC month at 20 per minute. The secret is shown once, so save it immediately. Every /api/v1 data endpoint requires it as a Bearer token. Only the demo routes do not.

export DRAFTKINGS_API_KEY='dk_...'

Keys start with dk_ followed by 64 hexadecimal characters. The service stores a SHA-256 hash and a short prefix, not the secret. That is why a lost key cannot be shown again: create a replacement and revoke the old one.

• Name keys after where they run, such as reporting-prod or laptop-tests. When a key leaks, the name tells you which system to fix.
• Read the key from an environment variable or a secret manager. Never put it in a client bundle, a public repository, a URL or a shared notebook.
• Keep browser code away from the key. Call your own backend, and let the backend call this API.
• The header must read exactly Authorization: Bearer dk_.... Anything else returns 401.

Step 3: make an authenticated call

Start with coverage, because it shows what is actually stored, then request five rows from a sport it reports as fresh. Each call spends one request from your allowance.

curl --fail-with-body "https://draftkingsapi.com/api/v1/coverage" \
  -H "Authorization: Bearer $DRAFTKINGS_API_KEY"

curl --fail-with-body "https://draftkingsapi.com/api/v1/pick6/projections?sport=NHL&limit=5" \
  -H "Authorization: Bearer $DRAFTKINGS_API_KEY"

If you would rather run a script, the Python quickstart does the same check with bounded requests and error handling: python3 draftkings-quickstart.py --sport NBA --limit 5. See what counts as a request.

Verify the response

A successful HTTP response is not proof of freshness. Inspect dataset, data, pagination and caveats, then check observed_at, source_updated_at, age_seconds and stale on each row.

• stale: true means no fresh observation for more than 15 minutes. The row is retained data, not a current offer.
• source_updated_at is null when the venue clock is unknown. Do not replace it with observed_at.
• is_paused: true on a Pick6 row means it must not be treated as selectable.
• An empty data array is a valid answer. It does not mean the endpoint failed.

Sources and status shows actual collection context. Terms are defined in the glossary.

Stuck? Email support@draftkingsapi.com with the request and the response, and never the key.

Rotate and revoke keys

An account can hold five active keys. Creating a sixth returns 409, so revoke an old key first. Rotation needs no downtime if you do it in this order.

1. Create a new named key in the dashboard and copy the secret.
2. Deploy the new secret to every system using the old key.
3. Confirm those systems are making successful requests.
4. Revoke the old key. Further requests with it return 401.

Extra keys do not add quota. All keys on an account share one allowance, so a runaway script on one key can exhaust the budget for every other key.

Handle the boundaries

A 401 means key authentication failed. A 429 means the shared account budget was reached. A 503 can mean storage or a dataset is unavailable. DFS can return 403 when access is not enabled on the host. Do not replace unavailable observations with invented data.

The errors and rate limits guide covers each status and what to do next. Independent service, no wagering: keys give technical access to stored observations and do not establish a redistribution license.

Check the recorded data

• Sources and status
• Measured coverage report
• Reliability Measured uptime and lag, where recorded.

Related resources