Current posture
odds-api uses API-key authentication, server-side plan enforcement, per-client access controls, Stripe and PayPal billing, server-side account records, and operational monitoring.
Enterprise security for odds-api
Security posture, API-key controls, subprocessors, vulnerability disclosure, and retention notes for teams evaluating odds-api for production and enterprise use.
Enterprise roadmap
Formal DPA terms, custom retention windows, scoped key permissions, and deeper audit exports are roadmap or contract-driven items.
Security contact
Send sensitive reports to security@odds-api.net. Do not open public GitHub issues for vulnerabilities or exposed credentials.
API-key rotation
Customer API calls authenticate with the X-API-Key header. Active accounts can keep up to five active keys, label them, rotate one key without affecting the others, and delete keys from the account page.
Key scoping
Server-side access controls enforce account status, monthly request quotas, rate limits, bookmaker access and enabled products.
The public docs and examples use customer API keys only. Internal service keys are not part of the public developer package.
Infrastructure posture
Account records and API credentials are managed server-side. Stripe and PayPal handle payment details. Public developer tools and documentation are available on GitHub. Contact support for infrastructure and subprocessor information needed for a security review.
Logging and monitoring
The platform keeps website request logs, API quota and usage counters, service health checks, and support diagnostics for operating the service. Incident artifacts can be captured during live debugging when required.
Customers should not place API keys in browser-visible code, public repositories, issue reports, screenshots, or support tickets.
Vulnerability disclosure
Email reports to security@odds-api.net with the affected URL, package, endpoint, reproduction steps, impact, and any relevant logs or screenshots with secrets removed.
We aim to acknowledge valid reports on a best-effort basis within 2 business days. Please avoid public disclosure until a remediation path has been agreed or the issue has been resolved.
Data retention
Stripe owns card data and payment method handling. PayPal owns PayPal wallet approval and payment handling. odds-api keeps account, subscription, usage, and billing-link records while the account is active and as needed for billing, legal, security, and support obligations.
History Lite provides the last 30 days of historical odds. Account and operational records follow their applicable billing, legal, security and support retention requirements.
Payment and developer services
Contact support for the subprocessor information required for your enterprise review.
| Provider | Purpose | Data class |
|---|---|---|
| Stripe | Subscription billing, invoices, payment method handling, and customer portal access. | Billing contact, subscription, invoice, payment, and tax-related data. |
| PayPal | Optional PayPal subscription checkout, approval, payment status, and lifecycle webhooks. | PayPal payer, subscription, payment status, and billing-link data. |
| GitHub | Public SDKs, MCP server, examples and OpenAPI exports. | Public repository metadata and contributor activity. |