How do I authenticate securely with the Pokerai API?
Keep your Pokerai API key in trusted server-side configuration, then send it as Authorization: Bearer $POKERAI_API_KEY or pass it to an official SDK client. Never expose a real key in browser code, a repository, logs, or public examples.
Authorization header (or configure an official SDK client with the same server-side key), and proxy browser requests through your backend. The public OpenAPI snapshot documents Bearer authentication; it does not document OAuth, key rotation, or a permissions model.Quick facts
| Authentication method | Authorization: Bearer $POKERAI_API_KEY, as documented by the public OpenAPI security scheme |
|---|---|
| Safe boundary | Server-side environment or secret store only; browsers call your backend, not Pokerai API with a key |
| Minimal operation | POST /v1/gto/preflop is a documented presolved lookup with 401 and 429 responses |
| Free tier | 1,000 presolved lookups + 25 real-time solves / month |
| Use boundary | Training, coaching, hand review, study, and research only; no real-money RTA |
Send the documented Authorization header
Use a placeholder environment variable in code and documentation. Create and manage keys through the account flow; do not paste a real key into source control, a client bundle, screenshots, support tickets, or logs.
curl -s https://pokerai.bet/v1/gto/preflop \
-H "Authorization: Bearer $POKERAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{"hole_cards":"AhKh","positions":{"hero":"MP"},"preflop_actions":[{"position":"SB","action":"small blind","amount":0.5},{"position":"BB","action":"big blind","amount":1},{"position":"UTG","action":"raise","amount":3}]}'Use an SDK only on the server
The official Python and JavaScript clients accept a key when constructing their authenticated client. Pass the key from server-side configuration, not from a browser-visible variable. The SDK is a client convenience; its request and error contract remains the current public OpenAPI snapshot.
For a web app, keep the Pokerai request in a server route or backend service. Your browser can call that route with your own session and validation rules, while the backend adds the API key and returns only the response data the user may see.
Handle 401, 403, and 429 safely
For 401, the public contract says the API key is missing or invalid: verify that the server loaded the intended secret and that the header is exactly Bearer authentication. Do not send the key to the client to debug it. The operation's public contract also declares 429 when monthly quota is exceeded; surface a quota message and check the dashboard or quota documentation instead of retrying until success.
If your integration receives 403, treat it as access denied, preserve no secret in the error report, and inspect the documented response and account context. Do not infer an OAuth flow, role, scope, entitlement, key-rotation process, or other permission model that the current public API has not documented.
Quota and acceptable use
The minimal preflop request uses one presolved lookup. Free accounts have 1,000 presolved lookups and 25 real-time solves per month; check returned usage or the dashboard rather than duplicating account accounting in the client.
Use Pokerai API for training, coaching, hand review, study, and research only. Real-time assistance at real-money tables is prohibited. Do not connect authenticated output to live-table automation or present it as a real-time action instruction.
OpenAPI provenance
This Guide is based on the public OpenAPI snapshot, including its Bearer authentication scheme and the documented POST /v1/gto/preflop operation. Check the current API Reference and snapshot before changing an integration; this Guide makes no claim beyond that published contract.
Relevant public operation
Start with one server-side, authenticated presolved lookup and validate its schema against the current public contract.
| Endpoint | Authentication use | Use it for |
|---|---|---|
POST /v1/gto/preflop | Bearer Authorization header or official SDK client | A minimal authenticated preflop strategy lookup |
Authentication, API, and provenance links
- Authentication docs — account flow and documented API authentication
- Quota docs — current monthly limits and account usage guidance
- API Reference — current preflop request, response, and security contract
- OpenAPI snapshot — machine-readable English public contract and provenance
- Python SDK — official package entry point
- JavaScript SDK — official package entry point
- MCP server — official package entry point
- llms.txt — concise LLM entry point