> ## Documentation Index
> Fetch the complete documentation index at: https://docs.etonecarg.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and API Keys

> Understand what the caller needs, what the server owns, and how entitlements affect hybrid responses.

# Access and API Keys

Sports MCP Server has two distinct access layers: caller access to the MCP server itself, and server-side access to upstream providers.

## Split the access model correctly

<Tabs>
  <Tab title="What the caller needs">
    The caller needs one bearer API key scoped to the `sports-mcp-server` product.

    That key is used to:

    * authenticate the request
    * apply product-scoped policy
    * enforce rate limits and quotas
    * attribute usage to the correct customer context
  </Tab>

  <Tab title="What the server owns">
    The server owns upstream routing and upstream credentials.

    Expected server-side keys:

    * `GNS_API_KEY`
    * `ON_API_KEY`
    * `ON_CURRENT_API_KEY`
    * optional `LEGACY_CONNECTIVITY_API_KEY`

    The caller should never pass upstream provider keys directly.
  </Tab>

  <Tab title="What entitlements change">
    Entitlements do not change the public tool contract, but they can change how complete one answer can be.

    Expected host behavior:

    * treat `partial` and `limitations` as normal
    * do not assume a missing hybrid section means negative business logic
    * preserve `sources` for QA and supportability
  </Tab>
</Tabs>

## Source families behind the contract

| Source family                   | What it owns                                                                                             |
| ------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `GSD Lookup`                    | Deep sports truth such as schedule truth, standings, structure, stats, actions, odds, and roster context |
| Supported availability contract | Watchable schedules, live availability overlays, and where-to-watch flows                                |
| `On Programs`                   | Direct program context and reverse program linkage flows                                                 |
| `SportsEventCurrent`            | Freshness on already linked watch/program rows only                                                      |
| `GSD Metadata`                  | Bounded enrichments like images, editorial, and translations                                             |
| Legacy connectivity             | Fallback evidence only                                                                                   |

## Integration rules

* Keep caller auth separate from upstream provider auth.
* Avoid exposing the bearer key directly to public browser clients.
* Expect partials when one upstream source is unavailable or not entitled.
* Keep provenance visible when rendering hybrid answers.

## Read this next

* [Access and Entitlements](/sports-mcp-server/reference/access-and-entitlements)
* [API Keys and Browser Access](/sports-mcp-server/reference/api-keys-and-browser-access)
* [Protocol, Auth, and Errors](/sports-mcp-server/reference/protocol-auth-and-errors)