How does authentication work for the WorkoutDB exercise API?
WorkoutDB uses simple API-key authentication: send your key in an X-API-Key header on every request. There is no OAuth flow and no token refresh — create a key in the dashboard and start calling immediately.
How to authenticate
Sign up for a free account, generate a key in the dashboard, and include it as X-API-Key: <your-key> on each request. That single header identifies your account, applies your plan limits, and ties usage to your quota. Requests without a valid key receive a 401.
Treat the key like a secret: call the API from your server (or a backend proxy) rather than embedding it in client-side code, so it never ships in a browser or mobile bundle. You can rotate keys at any time from the dashboard if one is exposed.
- One header — X-API-Key — on every request; no OAuth, no token refresh.
- A missing or invalid key returns 401; usage counts against your plan.
- Keep keys server-side; rotate them in the dashboard if leaked.
- The free tier issues a key with no credit card required.
Related questions
- Does WorkoutDB use OAuth or JWTs?
- No. Authentication is a single static X-API-Key header, which is simpler to integrate and requires no refresh logic.
- Where should I store my API key?
- On the server, in an environment variable or secret store. Call the API from your backend (or a Route Handler/proxy) so the key never reaches the client.
Build it on WorkoutDB
~873 exercises with demo video, ranked search, and four languages — over a clean REST API. Start free: 5,000 requests/month, no credit card.