API Authentication
Production calls use bearer tokens issued from the authenticated API keys page. Tokens must never be exposed in public browser code.
Section
11 / 27
Live API examples
Jump from the docs to real public pages that use the same read models.
Bearer token
Send the live API key in the Authorization header from a server-side integration. Store the raw token in a secret manager and rotate it if it is exposed.
curl -H "Authorization: Bearer YOUR_API_KEY" \ "https://api.lotteryfeedapi.com/v1/results/latest?state=MD&ball_count=3&short=1&limit=25"
Test tokens
Reserved lf_sandbox_* tokens are treated as sandbox credentials for public read endpoints. The exact lf_test_demo_sandbox token remains available for legacy examples; arbitrary lf_test_* values are not sandbox credentials. Sandbox tokens are useful for SDK tests and CI smoke checks because they return deterministic fixtures instead of live lottery data. Production integrations should use lf_live_ keys issued to the customer workspace.
Key storage
Raw keys are displayed only when created. Store the token securely, use the visible prefix to identify it later, and revoke or rotate the key from the authenticated account.
Access freshness
A workspace plan can apply a delivery delay after a result is available in the feed. This plan delay is separate from the official publication time, ingestion target, and public page cache refresh interval.
Next: API key scopes