SPORTHOUSE MODULE PLATFORM · V1 PREVIEW

Build what youth sports needs next.

Connect programs, teams, rosters, and schedules through an organization-approved API designed around explicit permissions and tenant safety.

Start building Explore Marketplace →

✓ OAuth with PKCE✓ Granular scopes✓ Organization consent✓ Audited access

SIGNED WEBHOOKS

Know what changed, then prove who sent it.

Sporthouse signs the exact request body and retries transient failures. Treat the delivery ID as the idempotency key and reject timestamps older than five minutes.

Delivery headers

X-Sporthouse-Event: Event type
X-Sporthouse-Delivery: Stable delivery ID
X-Sporthouse-Timestamp: Unix timestamp
X-Sporthouse-Signature: v1 HMAC-SHA256

Subscribed events

program.updatedregistration.createdroster.updatedteam.updatedschedule.updatedpayment.status_changed

Payloads contain organization-scoped identifiers and the specific change, not unrestricted records.

Python signature verification

import hashlib, hmac

key = hashlib.sha256(webhook_secret.encode()).digest()
signed = f"{timestamp}.".encode() + raw_request_body
expected = hmac.new(key, signed, hashlib.sha256).hexdigest()
hmac.compare_digest(f"v1={expected}", signature_header)

QUICKSTART

From idea to authorized app.

Private applications can connect to the organization that created them. Public Marketplace publishing remains review-gated while the ecosystem is established.

01
Register your app
Create a private application in the Developer Console and save the one-time client secret.
02
Request exact scopes
Send an administrator through Authorization Code with PKCE S256 to approve only the access you need.
03
Call the API
Use a short-lived Bearer token against the versioned API and rotate refresh tokens on every exchange.

READ-ONLY API V1

A focused contract, not an internal back door.

The first surface is intentionally small and allowlisted. Every request is pinned to the authorizing organization.

GET/api/v1/programs

Program identity, dates, sport, status, location, and capacity.

programs:read

GET/api/v1/teams

Teams associated with programs owned by the authorized organization.

teams:read

GET/api/v1/rosters

Registration, participant, program, team, and roster status identifiers.

rosters:read

GET/api/v1/schedules

Organization events, times, locations, teams, and operational status.

schedules:read

Request

curl https://api.sporthouse.ai/api/v1/programs \
  -H "Authorization: Bearer $SPORTHOUSE_ACCESS_TOKEN"

SECURITY BY CONTRACT

Permission is a product feature.

Sporthouse apps are designed to fail closed. Credentials are never stored in plaintext, access can be revoked immediately, and every API request creates an audit record.

5 minone-time authorization code

1 houraccess-token lifetime

30 daysrotating refresh window

90 daysAPI access audit retention

WHAT'S NEXT

Building the ecosystem in safe layers.

LIVE

OAuth + API gateway

Consent, PKCE, scoped tokens, tenant isolation, rate limits, and audits.

PHASE 3

Signed webhooks

Retryable, idempotent event delivery with testing and failure visibility.

REFERENCE MODULE

Tournaments

The first add-on built against the same contract available to partners.

PARTNER ACCESS

Review + publishing

Certification, listings, versioning, billing, and operational controls.