Build any golf app, free.

Quickstart

Reads and gross scoring need no key. Try it now:

# Find a course (no key)
curl "https://api.opengolfapi.org/v1/courses/search?q=pebble"

# Score a game — gross, keyless
curl -X POST "https://api.opengolfapi.org/api/v1/compute/skins" \
  -H "content-type: application/json" \
  -d '{"players":[{"player_id":"a","holes":{"1":4,"2":5}}],"holes":[{"hole":1,"par":4},{"hole":2,"par":5}]}'

# Everything you can do (always current)
curl "https://api.opengolfapi.org/api/v1/capabilities"

Auth — Sign in with OpenGolf

Fastest path: opengolfapi.org/id — email → 6-digit code → key on screen in 60 seconds. The raw flow below is for automating it.

Your email IS your OpenGolf ID. You never create one — you prove the one your email already maps to. The ID is a pure function of your email (ogid_ + sha256(lowercase(email))[:16]), so the same email = the same ID, everywhere, computed by any app or AI — portable, passwordless, self-owned. "Minting" = proving you control that email (a code or one-click link), which verifies your ID and issues your key bound to it.

The email is three things at once: the ID (derived), the proof (you control it), and the anti-abuse gate (one real inbox = one real identity). That's why it's the anchor — and it's just one click.

Reads + gross scoring are keyless. To build (contribute data, higher limits) you need a key — and no OpenGolf ID, no key. Getting one is the OIDC sign-in:

1. POST /oauth/start {email, client_id} — we email a 6-digit code (your email is your OpenGolf ID).
2. POST /oauth/code {email, otp, client_id, redirect_uri, scope, code_challenge} (PKCE S256) → auth code.
3. POST /oauth/token → access_token. Use it as X-OpenGolf-Token.
4. POST /api/v1/developer/keys with that token + your email → your key (shown once).
5. Prefer a page? opengolfapi.org/developer does all of this in 60 seconds — email, code, key.

Turnkey for an AI: an agent drives the whole thing through the MCP — request_sign_in_code(email) → complete_sign_in(code) → create_dev_key(). The agent makes every call; the human just supplies the emailed code (or clicks the one-click magic link, POST /oauth/send-verify → click). Everything except the one email confirmation is automated.

Have an existing key? Verify/activate your OpenGolf ID in one click — POST /oauth/send-verify {email} emails a magic link; clicking it verifies all your keys in place (no code change). Or POST /api/v1/developer/keys/link from a signed-in session.

Build a golf app in minutes

Three pieces and you have a working app — and it's OpenGolf-native (identity + attribution) from line one.

# 1 · identity — one component (npm i @opengolfapi/sign-in)
<SignInWithOpenGolf clientId="my-app" redirectUri="https://my.app/callback" />

# 2 · read a course (no key)
curl "https://api.opengolfapi.org/v1/courses/search?q=pebble"

# 3 · score a game (no key)
curl -X POST "https://api.opengolfapi.org/api/v1/compute/skins" -d '{…card…}'

OpenGolf ID is the spine. Reads and scoring are open, but the moment your app goes live — minting a key, writing data — it passes through OpenGolf ID. No ID, no key. So every app is authenticated and attributed from minute one: the standard is enforced at birth, not bolted on later.

Resilience & fallback

OpenGolf ID is the convenient front door — but your app degrades gracefully without it. By design, not by luck:

• Tokens verify offline. The id_token is RS256; check it against cached JWKS (@opengolfapi/sign-in/verify) — a brief identity outage never logs your users out.
• Your app owns its data. Store the sub (the OpenGolf ID) as your user key; your database is the system of record, not us.
• Core features need no login. Course reads and gross scoring are keyless — your main loop works with zero auth.
• It's an open standard. Open spec, ODbL data, deterministic IDs — anyone could run a compatible issuer. No rug to pull.
• Keep a second door if you like. It's plain OIDC — offer email/Google/Apple alongside for belt-and-braces.

The open standards

Each is an open standard you can adopt on its own. OpenGolf ID is the glue.

Live capabilities

Pulled from the API right now — never stale:

The MCP — for AI agents

56 tools for Claude, ChatGPT, Gemini & Cursor. npx -y @opengolfapi/mcp-server — full setup + tool list at /mcp.

Every capability on this page is an MCP tool or a keyless endpoint — so an AI agent can build a golf app against OpenGolf end-to-end: search courses, wire "Sign in with OpenGolf," score games, send shots & moments. And because writing always passes through OpenGolf ID, each app an agent spins up is locked to the standard the instant it goes live — authenticated and attributed, no insecure sprawl. Point your agent at the MCP and describe the app you want.

API reference

The full machine spec, rendered live from openapi.json — always current.