betfair app key and session token: two fields that fail apart

A betfair app key is the credential that labels an application calling the Exchange API, while a session token identifies the account behind the request. They sit next to each other in setup notes and error logs, yet they answer different questions. On a desktop screen, one field describes the software; on a mobile browser tab, the other describes the signed-in user. That separation explains why a page can look healthy while a request still fails.

Why a betfair app key is not the Exchange login password

The betfair app key is not a substitute for the username and password used on the main Betfair site. It belongs to the developer side of the account, where a dashboard lists applications and their identifiers. A reader comparing screens may see a key that is visible or copyable while the password field sits elsewhere, on the login page. Treating them as one credential leads to wasted checks: changing a password will not repair a request that is missing the key, and rotating a key will not change who is signed in.

Where the betfair app key sits in an Exchange API request

The betfair app key normally travels in a request header, while the session token carries the permission of the account. In practical page terms, the key is the label attached to the calling application; the token is the proof that a person completed authentication. A developer testing fixtures, live odds, or market data may keep both values open in separate tabs because one identifies the tool and the other identifies the session. If the key is present but the token is stale, the request still has a missing half.

When the Exchange key and session token disagree

An authentication error can appear even when the key field looks correct, because the session token may have expired or belong to a different environment. The useful page action is to compare the application label, the token age, and the account shown in the developer view before changing anything. A key copied from one application and a token created for another can sit comfortably in the same notes but fail when combined. That is not a mysterious app fault; it is two separate records pointing at two separate contexts.

Testing one key across desktop and mobile market-data views

A common scene is a desktop dashboard beside a mobile browser session, with the betfair app key held constant and the request pattern changed. The key should not need a new value just because the screen size changes. What changes is the way the interface asks for data: the mobile view may request fewer markets at once, while the desktop view may keep more columns open. Logging the application label beside each test makes those differences visible without confusing them with authentication.

What to check before replacing the credential

Before replacing the betfair app key, check the header name, the token status, the selected environment, and the permissions attached to the account. A missing header can look like a bad key; an expired token can look like a key that stopped working. It also helps to test one request for a simple fixture list before opening several live odds views at once. If the simple request succeeds, the key is likely doing its job and the issue sits in the session or the request scope.

Reading the developer page like a support note

The developer page is most useful when read as a support note rather than a settings menu. The application name tells support which software is calling; the key tells the API which application is allowed; the session token tells the service who is asking. Keep those three descriptions separate in documentation. When a colleague asks why a request failed, a screenshot of the application label, the last token refresh, and the request path explains more than a paragraph about the wrong password.

For anyone maintaining an integration, the betfair app key is best treated as an application label with a matching token workflow, not as a spare password. The page elements that matter are the application name, the header carrying the key, the session token state, and a small test request that proves the pair works together. Once those records line up, live odds and fixture views become easier to review without guessing which field broke.