Authentication
One key per account. It goes in the path. It can be rotated at any time, and rotating it takes effect immediately.
How a request is authenticated
The last segment of every path is apikey= followed by your key. The API looks the key up and rejects the request if it does not exist.
curl "https://api.uractor.com/oscars/year=2026/apikey=YOUR_API_KEY"There is no Authorization header, no OAuth flow and no signed request. That is a deliberate simplification for an API that only ever serves public data.
When it fails
A missing, unknown or revoked key returns 403 with the same body in every case — the API does not tell you which of the three it was.
{
"error": "Forbidden - Invalid API Key"
}Calling it from a browser
Cross-origin requests are allowed, so the API can be called directly from front-end code. Be clear-eyed about what that means: any key you ship to a browser is public. Anyone can read it out of your bundle or their own network tab. That is true of every API whose key travels in the request — it is not a flaw you can configure away.
What matters is how much a leaked key is worth, and here the answer is: very little. It grants read access to public awards data and nothing else. Someone who takes yours can do exactly what they could have done by signing up for their own in ten seconds.
Every key is capped at 60 requests per minute, so a key someone else picks up cannot be used to hammer the API in your name. If your own traffic starts returning 429 unexpectedly, that is worth investigating — rotate the key and the old one stops working immediately.
Still, the better pattern is to call the API from your server and cache the result. You get to keep the key out of public view, you serve your users faster, and you stay well clear of the limit. See limits and fair use.
Rotating a key
Rotation is on the key page. Requesting a new key issues one immediately and revokes the old one in the same operation — there is no grace period and no overlap window, so deploy the new key before you rotate, or accept a short gap.
Rotate if the key has appeared somewhere public, if it is in a repository you are about to open source, or if you simply want a fresh one.
Where keys live
Keys are stored server-side and are never readable by other users. The account page cannot read or write the key store directly; it asks the API to do it, and the API checks your signed-in identity first. That means a compromised browser session cannot enumerate anyone else’s key.