Authentication - Enter Theatre API

Overview

The Enter Theatre API supports two access levels:

Access Level	Rate Limit	Use Case
Public (no key)	100 requests/day	Testing, small projects
API Key	10,000 requests/day	Production apps

All GET endpoints are publicly accessible. Write operations (POST, PUT, DELETE) require Supabase authentication.

Rate Limits

Without API Key

Anonymous requests are rate-limited by IP address:

100 requests per day
Resets at midnight UTC

curl https://entertheatre.com/api/shows

With API Key

Authenticated requests using an API key get higher limits:

10,000 requests per day (default)
Resets at midnight UTC

curl https://entertheatre.com/api/shows \
  -H "Authorization: Bearer et_your_api_key_here"

Rate Limit Headers

Every response includes rate limit information:

Header	Description
`X-RateLimit-Limit`	Maximum requests allowed
`X-RateLimit-Remaining`	Requests remaining in window
`X-RateLimit-Reset`	Unix timestamp when limit resets

Rate Limit Exceeded

When you exceed the rate limit, you’ll receive a 429 response:

{
  "error": "Rate limit exceeded",
  "message": "Public API limit of 100 requests per day exceeded. Sign up for an API key for higher limits.",
  "limit": 100,
  "reset": 1701388800
}

Getting an API Key

Create an account

Go to Developer Dashboard

Visit entertheatre.com/dashboard/api-keys

Create a new key

Click “Create New Key” and give it a descriptive name

Copy your key

Copy your API key immediately - you won’t be able to see it again!

Using Your API Key

Include your API key in the Authorization header:

curl https://entertheatre.com/api/shows \
  -H "Authorization: Bearer et_abc123..."

const response = await fetch('https://entertheatre.com/api/shows', {
  headers: {
    'Authorization': 'Bearer et_abc123...'
  }
});
const shows = await response.json();

import requests

response = requests.get(
    'https://entertheatre.com/api/shows',
    headers={'Authorization': 'Bearer et_abc123...'}
)
shows = response.json()

Invalid API Key

If you provide an invalid or revoked API key, you’ll receive a 401 response:

{
  "error": "Invalid API key",
  "message": "The provided API key is invalid or has been revoked."
}

Write Operations

For create, update, and delete operations, you need to be authenticated via Supabase session (not API key). This is intended for the admin dashboard, not external API consumers.

Best Practices

Keep keys secret

Never commit API keys to version control or expose them in client-side code.

Use environment variables

Store your API key in environment variables like ENTER_THEATRE_API_KEY.

Monitor usage

Check your usage in the dashboard to avoid hitting rate limits.

Rotate keys

If a key is compromised, revoke it immediately and create a new one.

​Overview

​Rate Limits

​Without API Key

​With API Key

​Rate Limit Headers

​Rate Limit Exceeded

​Getting an API Key

​Using Your API Key

​Invalid API Key

​Write Operations

​Best Practices