Authorization

Authentication tells TournamentSuite who you are. Authorization determines what you can do.

Project-level isolation

All resources — tournaments, participants, matches, webhooks — belong to a project. Your credentials (API key or OAuth 2 client) can only access resources within the project they were created in. There is no way to read or write data across projects using a single set of credentials.

This means you can safely use separate credentials for each environment (development, staging, production) without any risk of cross-contamination.

Scope-based access control

API keys and OAuth 2 tokens carry scopes that limit the operations they can perform. A key with read:tournaments can list and retrieve tournaments but cannot create or modify them.

When you create an API key, you choose which scopes to grant. Request only the scopes your integration actually needs — this reduces the blast radius if a key is ever compromised.

See Scopes for the full list of available permissions.

Organizer vs. participant actions

Some endpoints are restricted to organizers — users who own or manage a tournament. Others are available to participants (registered players or teams). The endpoint catalog marks each endpoint with its required access level.

For example:

• POST /tournaments — organizer only
• POST /tournaments/:id/participate — authenticated user (participant)
• GET /tournaments/:id — public

Checking permissions at runtime

If your integration receives a 403 Forbidden, the token or API key lacks the required scope or role for that resource. Inspect the response body for the error.code field:

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_PERMISSIONS",
    "message": "The 'manage:tournaments' scope is required for this operation."
  }
}

Add the missing scope when regenerating your API key, or re-request the OAuth 2 token with the correct scope.