PokerDataGet an API key
Menu

Authentication

Bearer keys for the preflop ranges API; a Studio session for the postflop API.

Preflop ranges API

Authenticate with an API key sent as a Bearer header. Keys start with pdk_; copy yours from PokerData API.

cURL
curl "https://pokerdata.io/api/v1/ranges/nl/v2/range?stack=100&spot=UTG_60%25_HJ_Call" \
  -H "Authorization: Bearer pdk_YOUR_KEY"
401 response
{
  "error": "This endpoint requires an API key from an active subscription. Subscribe ($100/mo) and manage keys at https://pokerdata.io/api.",
  "docs": "https://docs.pokerdata.io"
}

A request without a valid key from an active subscription gets a JSON 401 with a WWW-Authenticate: Bearer header.

Key behavior worth knowing:

  • Discovery endpoints are free. /nl, /nl/v2, /plo, and /plo9 need no key at all — use them to explore coverage before subscribing.
  • Keys survive a lapse. If your subscription lapses, keys stop working but are not deleted; they resume when the subscription does.
  • All of your keys share one rate-limit budget. Minting more keys does not buy more throughput — see rate limits.
  • The dashboard displays a masked key; Copy writes the complete secret to your clipboard. Treat it like a password.

Postflop API

The replay-pack endpoints are part of Poker Study AI and use its normal sign-in rather than pdk_ keys: requests are authenticated by your Clerk session cookie on www.pokerstudy.ai, and require an active Studio subscription.

  • Not signed in → 401 {"error": "sign in required"} on Poker Study AI.
  • Signed in without Studio → 403 {"error": "studio required"} on Poker Study AI.

The pokerdata.io archive download (/api/postflop/download/<pack>) is separate: it requires a $50 purchase of that pack. Signing in does not include the file. An unpaid request redirects to checkout.

This makes the postflop API a same-site/browser-session API today — it is served to the in-app viewer at pokerstudy.ai/replays, and the same JSON is yours to script against from an authenticated session.

MCP OAuth

The hosted MCP server at https://pokerdata.io/api/mcp accepts two credentials.

  • A pdk_ API key, unchanged, including the npm stdio bridge and clients that send Authorization: Bearer pdk_….
  • An OAuth 2.0 access token from a client that can sign in, which is how Claude (claude.ai, Claude Desktop, and Claude Code) connects.

OAuth uses the authorization-code flow with PKCE (S256), protected-resource metadata, authorization-server metadata, dynamic client registration, and client ID metadata documents. The sign-in step is the PokerData account. The access token is bound to that account's email, so it sees the same plan and the same usage meter as a pdk_ key on the account. Tokens are stored as hashes. Access tokens last one hour and refresh tokens rotate.

With no credential, initialize, tools/list, the catalog tools, and 6-max NL cash preflop still answer. A tool that needs an account, called with no credential, returns HTTP 401 and a WWW-Authenticate challenge so the client can start sign-in.

Discovery:

  • https://pokerdata.io/.well-known/oauth-protected-resource
  • https://pokerdata.io/.well-known/oauth-protected-resource/api/mcp
  • https://pokerdata.io/.well-known/oauth-authorization-server

Claude's hosted callback is https://claude.ai/api/mcp/auth_callback. Add the server in Claude as a custom connector with the MCP URL and no API key. See LLM tools & MCP.