Authenticate with an API key

You don't need a key to get English multiple choice questions. Many other features do, and a request that uses one of them without a key gets a 401 or 403 response. Keys come with a subscription.

Send the key in the X-API-Key header

Put the key in the X-API-Key request header on every request. Header names aren't case sensitive, so x-api-key works too. Send the key on its own, with no Bearer prefix and no quotes around it.

The examples below ask for questions in Spanish (language=es), which needs a key. They read it from a TRIVIA_API_KEY environment variable, so it doesn't end up in your code.

curl

curl -H "X-API-Key: $TRIVIA_API_KEY" \
  "https://the-trivia-api.com/v2/questions?limit=5&language=es"

Python

With requests:

import os
 
import requests
 
response = requests.get(
    "https://the-trivia-api.com/v2/questions",
    params={"limit": 5, "language": "es"},
    headers={"X-API-Key": os.environ["TRIVIA_API_KEY"]},
    timeout=10,
)
response.raise_for_status()
 
for question in response.json():
    print(question["question"]["text"], "→", question["correctAnswer"])

JavaScript

fetch in Node 18 or later:

const params = new URLSearchParams({ limit: "5", language: "es" });
const response = await fetch(`https://the-trivia-api.com/v2/questions?${params}`, {
  headers: { "X-API-Key": process.env.TRIVIA_API_KEY },
});
 
if (!response.ok) {
  throw new Error(`The Trivia API responded with ${response.status}: ${await response.text()}`);
}
 
const questions = await response.json();
console.log(questions[0].question.text);

Keep the key on your server

Anyone can read a key that's in code running in their browser, and requests made with it use up your credits. Call the API from your own server or serverless function, and have your frontend call that instead. Don't put the key in frontend code or in environment variables that get bundled into it, such as Next.js NEXT_PUBLIC_ variables or Vite VITE_ variables.

Which features need a key

Your plan decides which of these your key can use. Plain GET /v2/questions requests for English text_choice questions work without a key, as do /v2/tags and fetching an existing quiz.

When you do send a key, every request counts against its monthly credits, including ones that would work without it.

Troubleshooting

The rate limit is 100 requests every 5 seconds per key, or 20 every 5 seconds per IP address without one. If you're limited at 20 even though you send a key, the API isn't recognising it: a request for plain English questions with an unknown key is treated as if it had no key, so it doesn't fail.