LC8 Platform

API, widget e chiavi reveal-once

API pubbliche read-only per widget e API di management protette da scope, entitlement e rate-limit tier. LC8 e' il primo tenant, non il confine del prodotto.

Secret mai persistitiRate tier esplicitiWidget embeddabili

Sandbox

Quick start

Widget standingsbash

curl https://api.lc8.run/v1/widgets/standings/<tournament_id> \
  -H 'authorization: Bearer lc8demo_<32-hex>'

Il prefisso lc8demo_ e' finto: le chiavi reali si creano dal cockpit admin e il plaintext compare una sola volta.

Routing

Surface

API pubbliche

Standings, matches, teams, players, media

Tenant API

Fantasy e management con entitlement

Widget CDN

Embed snippet con origin allowlist

Key ops

Reveal, rotate, revoke

Public + tenant API

Endpoint catalog

GET

/v1/widgets/standings/{tournament_id}

Classifica pronta per embed pubblico.

scope: read:public.standings

GET

/v1/widgets/matches/{tournament_id}

Calendario, risultati e stato partita.

scope: read:public.matches

GET

/v1/fantasy/leagues/{league_id}/leaderboard

Classifica fantasy privata, tenant-scoped.

scope: read:tenant.fantasy

API keys

Reveal-once lifecycle

Create

Il cockpit mostra il plaintext una sola volta.

Store

Il backend conserva solo prefix, hash KDF, scope, tier ed entitlement.

Rotate

Se una chiave finisce in screenshot, fixture o client code, va revocata e sostituita.

Authorization

Scope vocabulary

read:public.standingsreadclassifica torneo

read:public.matchesreadcalendari, risultati, match-center

read:public.teamsreadcard squadra, team_card widget

read:public.playersreadmarcatori, top scorers

read:public.mediareadmedia pubblica

read:tenant.fantasyreadclassifica fanta privata

write:tenant.matcheswriteinserimento eventi organizzatore

admin:tenant.api_keysadminrotazione e revoca chiavi

Gateway

Rate limit category

public_widgetpublicwidget embed; solo scope read:public.*

partnerorganizerintegrazioni organizzatore

internalplatformtooling interno LC8

Embed sandboxhtml

<div id="lc8-standings"></div>
<script
  src="https://cdn.lc8.run/widget.js"
  data-kind="standings"
  data-tournament="00000000-0000-4000-8000-0000000070ee"
  data-api-key="lc8demo_<32-hex>"
></script>

Mai committare un plaintext API key. Mai metterla in screenshot, fixture, localStorage o codice client. Se accidentalmente esposta, ruotala dal cockpit admin.

<div id="lc8-standings"></div> <script src="https://cdn.lc8.run/widget.js" data-kind="standings" data-tournament="00000000-0000-4000-8000-0000000070ee" data-api-key="lc8demo_<32-hex>" ></script>