Connect other apps with the API

The Kordnate API lets another app work with your league’s data. For example, your website could show this week’s games, or a spreadsheet could pull in sign-ups. To let an app in, you make a token: a long secret code that works like a key.

Only league admins can make tokens. Each token works for your whole organization, and it can only do what you can do yourself.

Make a token

1. Open API tokens.
   • If you run one league, it’s under League Setup in the sidebar.
   • If your organization has more than one league, open your organization dashboard instead. It’s there in the sidebar.
2. Choose Create token.
3. Give it a name you will know later, like “Club website”.
4. Tick only what the app needs. See the next section.
5. Choose when it should stop working: after 30 days, 90 days, or 1 year.
6. Copy the token and keep it somewhere safe.

You see the token once. If you lose it, make a new one and turn the old one off.

Choose what the token can do

Tick this	And the app can
Read data	See seasons, teams, games, sign-ups, and the rest
Create and update records	Add and change things, like a game time or a team name
Delete records and run irreversible actions	Delete things, and do things that can’t be undone, like resetting a bracket
See players’ dates of birth, phone numbers, and emergency contacts	See private details about players and the families who signed up. Without it, the app never sees them.
Send email to families on your behalf	Do things that email someone, like approving a sign-up or inviting a coach

Start with Read data only. Add more when the app truly needs it. A token that can only read can’t break anything.

Use the token in an app

Your API lives at your dashboard’s web address, plus /api/v1/. If your dashboard is at https://riverside.kordnate.com/dashboard, your API is at https://riverside.kordnate.com/api/v1/.

The app sends the token with every request, in a header:

Authorization: Bearer <your token>

To check that a token works, ask for your leagues. Replace both parts in angle brackets:

curl -H "Authorization: Bearer <your token>" https://<your club>.kordnate.com/api/v1/leagues

You get back a list of your leagues in JSON. Each league has a short web-address name, the same one you see after /dashboard/ in your browser. It goes in every other address, like /api/v1/leagues/<league name>/teams.

Lists come 50 at a time. Each page tells the app how to ask for the next one.

Connect an AI assistant

Some AI assistants can use Kordnate for you. Add a connector in the assistant and give it your address plus /mcp, like https://riverside.kordnate.com/mcp.

The assistant sends you to Kordnate to sign in. Kordnate shows what the assistant is asking to do and which site it came from. Check both before you allow it. It then shows up in your API tokens list, and you can turn it off there at any time.

What the API can do

The API can work with seasons, teams, places you play, games and scores, players, sign-ups, registration windows, announcements, referees, coaches and volunteers, sponsors, waivers, and tournaments.

Some things stay in the dashboard on purpose:

• Money. Marking something paid, refunds, sponsor payments, and referee pay.
• Deleting a player.
• Uploading a logo.
• Children. An app can’t add a player under 18 directly. It can send an invite, and the player is added once a parent or guardian finishes sign-up and says yes. Medical notes are never sent or taken, whatever the token can do.

When something goes wrong

Every error comes back with a short code and a message that says what happened.

Code	What it means	What to do
unauthenticated	The token is wrong, has run out, or was turned off	Check you copied all of it, or make a new one
wrong_organization	The token is for a different organization	Use a token made in this organization
missing_scope	The token wasn’t given that permission	Make a new token with the right boxes ticked
forbidden	You aren’t allowed to do this yourself	Ask an admin who is, or do it in the dashboard
subscription_inactive	Your plan doesn’t include this part	Check Billing
not_found	It doesn’t exist, or you can’t see it	Check the league name and number in the address
conflict	The record can’t change right now, like a registration window that already has sign-ups	Read the message. It says why.
validation_failed	Something sent was missing or wrong	The errors part names each field to fix
rate_limited	Too many requests too fast	Wait and try again

An app can make 120 requests a minute with one token. Deleting is slower: 20 a minute.

Turn a token off

Open API tokens and choose Revoke on its row. It stops working at once. Choose Activity first to see what the token has been doing.

Turn a token off when the person who set it up leaves, or the app is gone. Then make a new one if you still need it.