Stake API Key Setup: How to Get One and What It Enables

Published 2026-04-06 · Tags: guides, api, product

Stake's API key grants programmatic account access. How to generate one, what it lets you do, security considerations, and the scripts actually worth building.

Stake offers an API key system that lets you access your account programmatically, read bet history, pull balance info, even place bets. Most players never use it. The ones who do get significant extra capability. This post walks through how to get one, what it enables, the security considerations, and why we use them to power our Stake Profile cards.

What a Stake API key is

Stake's API key is a bearer token that authenticates you to their GraphQL API without logging in via the browser. You paste it into a header (x-access-token) and any request is authorized as you.

Think of it as a "permanent password" that bypasses 2FA for API access. You generate it once and reuse it.

How to generate one

1. Log into Stake.com in your browser
2. Click your avatar → Settings
3. Navigate to API or Developer (the exact location changes periodically, check the settings menu)
4. Click Generate API Key
5. Copy the key immediately — Stake usually shows it only once, then stores a hashed version

The key looks something like: sk_live_AbCdEf123..., roughly 40 characters of random alphanumerics.

If you lose it, generate a new one; the old one stays valid until explicitly revoked.

What the API lets you do

Stake exposes most of the user-facing functionality through GraphQL:

Read operations (safe)

• Get your balance per currency
• Pull bet history (with filtering by date, game, currency, etc.)
• View your VIP level and wagering progress
• Read rakeback info
• Query game info (RTP, popular games, etc.)

Write operations (potentially destructive)

• Place bets programmatically
• Start / cash out crash rounds
• Rotate server seeds
• Change client seed
• Initiate withdrawals

Anyone with your API key can do any of these. Treat it like a password. More on security below.

Why we use API keys (for Stake Profile cards)

Our Sports Tracker's Stake Profile feature lets you connect your Stake API key to build a profile card with:

• Full sports bet history rendered as a 3D animated card
• P/L graph broken out by sport
• Stats (win rate, ROI, sharp score, favorite sport)
• Shareable URL / save-as-image

We encrypt your key with AES-256-GCM before storing it, and use it only to fetch your public bet data through a rate-limited proxy on our VPS. You can revoke the key at any time on Stake's side, our access immediately dies.

If you're curious about what's stored and how: see our security audit post (if published) or inspect our backend profile module which is open source.

Useful scripts with an API key

A few things advanced players build with their key:

1. Automated bet export

Pull your last 10,000 bets nightly into a local database. Feed into our Bet Analyzer offline or into your own custom scripts.

const r = await fetch("https://stake.com/_api/graphql", {
  method: "POST",
  headers: {
    "x-access-token": YOUR_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    query: `{ user { sportBetList(limit: 100) { edges { node { id amount payout ... } } } } }`,
  }),
});

2. Balance monitoring

Alert yourself when a specific coin's balance crosses a threshold. Useful for auto-withdrawing winnings or detecting unusual drops.

3. Auto-bet bots

Technically possible but heavily discouraged:

• Stake's T&Cs prohibit "automated play beyond normal" — if detected, account closure
• Bots don't beat the house edge, as covered in our Dice Strategy post
• The math doesn't care whether a human or script is placing bets
• Bot-caught accounts lose remaining balance

If you're thinking "but I've written a smart bot that will win", no. You haven't. Every gambling bot ever written loses at the same rate as manual play, because the game's house edge is deterministic.

4. Provably fair batch verification

If you have a custom verifier implementation, a key lets you pull the seed + nonce + payout for every bet in your history and audit them in bulk. Our Stake Verifier supports this workflow via bet archive upload (no API key needed), same result.

Security — treat the key like a master password

The key has the power to:

• Place bets (burns your balance)
• Initiate withdrawals (moves your balance out)
• Rotate seeds (could be used adversarially but mostly harmless)

Concrete threat models:

• Accidental commit to GitHub, easy to do if you use it in a script. Search the GitHub codebase for Stake API key leaks; it's a small mining industry. If your key leaks, revoke immediately.
• Malware with filesystem access, captures the key from a plaintext file, uses it to drain your balance. Store in a password manager, not a.txt file.
• Shared development machines — don't run scripts using the key on a machine you don't fully control.
• Phishing "use this tool, paste your API key", only paste your key into tools you fully trust. Good tools will let you revoke the key the moment their access is no longer needed.

Best practices:

1. Use a dedicated environment variable (e.g. STAKE_API_KEY) instead of hardcoding in scripts
2. Rotate the key periodically (every 90 days is reasonable for active scripts)
3. Revoke immediately if you suspect exposure (Settings → API → Revoke)
4. Don't share it with anyone, including support, Stake's support will never ask for your key
5. Check account login history regularly in Settings → Security → Activity log

API rate limits

Stake enforces rate limits on API requests:

• Roughly 60 requests per minute per key (varies by endpoint)
• Certain queries (like sportBetList with large limits) are more expensive and take more quota
• Exceeded limits return HTTP 429 "Too Many Requests"; wait a minute and retry

For normal usage (daily bet export, balance checks), you'll never hit limits. If you're running a heavy query every minute, you might.

Key differences from direct session auth

API keys are more powerful and more dangerous. Use them deliberately.

The "I lost my API key but it's still in use somewhere" fix

If you generated a key, used it in a script, and lost track of it:

1. Log into Stake → Settings → API
2. Revoke any keys you don't recognize
3. Generate a new one
4. Update your scripts with the new one

Old revoked keys become instant 401s on any future call — safe even if they're sitting in an old backup somewhere.

What NOT to build with an API key

• A "betting bot" that places bets based on pattern detection. Won't work, breaks T&Cs, account closure risk.
• A "reverse withdrawal" auto-cancel bot that cancels pending withdrawals programmatically. You lose the commitment device; this undermines your own discipline.
• A scraper that shares data for users who haven't opted in. Privacy violation.

What the API can't do

Good to know what it can't do:

• Bypass 2FA on withdrawals (withdrawals may require additional verification depending on amount)
• Access other users' bets (only yours)
• Change your email / password / 2FA settings (UI-only)
• Read encrypted messages (chat is read-only via API; sending requires session)

Net-net

Stake's API key is a powerful, permanent credential that enables automated access to your account. Most players don't need one. If you do use one (e.g. for our Profile cards, custom analytics, or controlled exports), treat it like a master password: store securely, rotate periodically, revoke immediately if exposed, and don't use it for betting bots that will get you banned.

Connect your key to view your full sports bet profile. Open the Tracker →