Riot API Authentication

Overview

The LoL Tracker Backend authenticates with the Riot Games API using an API key passed via the X-Riot-Token header. This guide covers everything you need to know about obtaining, configuring, and using Riot API authentication.

Obtaining a Riot Games API Key

Create a Riot Games Account

If you don’t already have one, create a Riot Games account at https://signup.leagueoflegends.com

Access the Developer Portal

Navigate to the Riot Developer Portal and sign in with your Riot account.

Generate a Development API Key

Once logged in, you’ll see your Development API Key on the dashboard.

Development API keys are regenerated every 24 hours and have strict rate limits. They’re perfect for testing and local development.

Copy your API key - it should look like this:

RGAPI-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Apply for a Production API Key (Optional)

For production applications, you’ll need to apply for a Production API Key:

Click on “Apps” in the developer portal
Register a new application
Fill out the application form with:
- Application name
- Description of your use case
- Expected API usage
Wait for Riot to review and approve your application

Production keys have higher rate limits but require approval. Development keys are sufficient for local testing.

Configuring the API Key

Environment Variable Setup

The LoL Tracker Backend loads the API key from a .env file using the dotenv package.

RIOT_API_KEY=RGAPI-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

How the API Key is Used

The API key is included in every request to the Riot Games API via the X-Riot-Token header:

index.js

const apiKey = process.env.RIOT_API_KEY;

// Example: Fetching player account data
const usuario = await axios.get(
    `https://americas.api.riotgames.com/riot/account/v1/accounts/by-riot-id/${nombre}/${tag}`,
    { headers: { 'X-Riot-Token': apiKey } }
);

All API endpoints use this same authentication pattern:

Player Stats Endpoint (index.js:18-68)

index.js

app.get('/api/jugador/:nombre/:tag', async (req, res) => {
    try {
        const { nombre, tag } = req.params;
        const apiKey = process.env.RIOT_API_KEY;

        // Fetch account data
        const usuario = await axios.get(
            `https://americas.api.riotgames.com/riot/account/v1/accounts/by-riot-id/${nombre}/${tag}`,
            { headers: { 'X-Riot-Token': apiKey } }
        );
        const miPuuid = usuario.data.puuid;

        // Fetch summoner profile
        const perfil = await axios.get(
            `https://la2.api.riotgames.com/lol/summoner/v4/summoners/by-puuid/${miPuuid}`,
            { headers: { 'X-Riot-Token': apiKey } }
        );

        // Fetch ranked data
        const rank = await axios.get(
            `https://la2.api.riotgames.com/lol/league/v4/entries/by-puuid/${miPuuid}`,
            { headers: { 'X-Riot-Token': apiKey } }
        );

        // ... process and return data
    } catch (error) {
        res.status(500).json({ error: 'Hubo un problema al buscar al jugador.' });
    }
});

Match History Endpoint (index.js:71-206)

index.js

app.get('/api/historial/:nombre/:tag', async (req, res) => {
    try {
        const {nombre, tag} = req.params;
        const apiKey = process.env.RIOT_API_KEY;

        // Fetch account PUUID
        const respuesta = await axios.get(
            `https://americas.api.riotgames.com/riot/account/v1/accounts/by-riot-id/${nombre}/${tag}`,
            { headers: { 'X-Riot-Token': apiKey } }
        )

        const miPuuid = respuesta.data.puuid;

        // Fetch match history
        const historialCompleto = await axios.get(
            `https://americas.api.riotgames.com/lol/match/v5/matches/by-puuid/${miPuuid}/ids?start=${variableInicio}&count=${variableCantidad}`,
            { headers: { 'X-Riot-Token': apiKey } }
        )

        // Fetch details for each match
        for(const partida of historial) {
            const detallePartida = await axios.get(
                `https://americas.api.riotgames.com/lol/match/v5/matches/${partida}`, 
                { headers: { 'X-Riot-Token': apiKey } }
            );
            // ... process match data
        }

        res.json(historialRevisado);
    } catch(error) {
        console.error("Error consultando a Riot:", error.response?.data || error.message);
        res.status(500).json({ error: 'Hubo un problema al buscar al jugador.' });
    }
});

Rate Limiting

Riot Games enforces strict rate limits on API requests to prevent abuse.

Development API Key Limits

Development keys have the following rate limits:

20 requests per second
100 requests per 2 minutes

These limits are per API key, not per endpoint.

Production API Key Limits

Production keys have higher limits that vary based on your application’s needs:

Typically 500-3000 requests per second
Custom limits negotiated during application approval

Handling Rate Limit Errors

When you exceed rate limits, the Riot API returns a 429 Too Many Requests response:

try {
    const response = await axios.get(url, { headers: { 'X-Riot-Token': apiKey } });
} catch (error) {
    if (error.response?.status === 429) {
        console.log('Rate limit exceeded. Retry after:', error.response.headers['retry-after']);
        // Implement retry logic here
    }
}

The current implementation in index.js does not handle rate limiting. For production use, implement retry logic with exponential backoff.

Rate Limiting Best Practices

Implement Caching

Cache frequently requested data (player stats, match history) to reduce API calls:

const NodeCache = require('node-cache');
const cache = new NodeCache({ stdTTL: 300 }); // 5 minute cache

const cachedData = cache.get(cacheKey);
if (cachedData) return cachedData;

Batch Requests

Group multiple requests together when possible to minimize API calls.

Monitor Usage

Track your API usage to stay within rate limits:

let requestCount = 0;
setInterval(() => {
  console.log(`Requests in last minute: ${requestCount}`);
  requestCount = 0;
}, 60000);

Implement Retry Logic

Use exponential backoff when rate limited:

async function retryRequest(fn, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    try {
      return await fn();
    } catch (error) {
      if (error.response?.status === 429 && i < maxRetries - 1) {
        await new Promise(r => setTimeout(r, 2 ** i * 1000));
      } else throw error;
    }
  }
}

Security Best Practices

Never expose your API key in client-side code, public repositories, or logs.

DO: Secure Practices

Store in environment variables

Always use .env files for local development:

.env

RIOT_API_KEY=RGAPI-your-key-here

The project includes .env in .gitignore to prevent accidental commits:

.gitignore

# dotenv environment variable files
.env
.env.development.local
.env.test.local
.env.production.local
.env.local

Use different keys for dev/prod

Maintain separate API keys for development and production environments:

Development: Use regenerating 24-hour keys
Production: Use approved production keys with monitoring

Implement server-side proxy

The LoL Tracker Backend acts as a proxy between your frontend and Riot API:

Frontend → Backend (with API key) → Riot API

This keeps the API key secure on the server, never exposed to clients.

Rotate keys regularly

For production applications:

Rotate API keys periodically
Have a key rotation plan in case of compromise
Monitor for unauthorized usage

DON’T: Insecure Practices

❌ Hardcode API keys in source code

// ❌ NEVER DO THIS
const apiKey = 'RGAPI-12345678-1234-1234-1234-123456789012';

❌ Commit .env files to Git

# ❌ NEVER DO THIS
git add .env
git commit -m "Add environment variables"

The .gitignore file already prevents this, but double-check before committing.

❌ Expose keys in client-side JavaScript

// ❌ NEVER DO THIS IN FRONTEND CODE
fetch('https://americas.api.riotgames.com/...', {
  headers: { 'X-Riot-Token': 'RGAPI-...' }
});

Always proxy through your backend server instead.

❌ Log API keys

// ❌ NEVER DO THIS
console.log('Using API key:', process.env.RIOT_API_KEY);

Testing Authentication

Verify your API key is working correctly:

Test with a simple request

Start your server and make a request to a known player:

curl http://localhost:3000/api/jugador/Faker/KR1

Check for authentication errors

Common authentication error responses:401 Unauthorized: Invalid or expired API key

{
  "status": {
    "status_code": 401,
    "message": "Unauthorized"
  }
}

403 Forbidden: API key doesn’t have required permissions

{
  "status": {
    "status_code": 403,
    "message": "Forbidden"
  }
}

Monitor server logs

The server logs each request:

index.js:23

console.log(`\n--- NUEVA BÚSQUEDA: ${nombre} #${tag} ---`);

Watch for errors in the console to debug authentication issues.

Troubleshooting

API key not found error

Error: Cannot read property of undefined (reading 'RIOT_API_KEY')Solutions:

Ensure .env file exists in project root
Verify require('dotenv').config() is called at the top of index.js
Check .env file contains: RIOT_API_KEY=your_key_here
Restart the server after modifying .env

401 Unauthorized errors

Cause: Invalid or expired API keySolutions:

Development keys expire every 24 hours - generate a new one
Copy the entire key including the RGAPI- prefix
Ensure no extra spaces or quotes in .env file
Verify you’re logged into the correct Riot account

429 Rate limit exceeded

Cause: Too many requests in a short time periodSolutions:

Implement caching for frequently accessed data
Add delays between requests
Apply for a production API key for higher limits
Implement request queuing with rate limiting

CORS errors when testing

Cause: Frontend trying to call Riot API directlySolution: Always proxy through the backend:

// ✅ Correct - call your backend
fetch('http://localhost:3000/api/jugador/Faker/KR1')

// ❌ Wrong - direct Riot API call from frontend
fetch('https://americas.api.riotgames.com/...')

Next Steps

API Overview

Explore all available endpoints and start making requests

Quick Start

Make your first API request in under 5 minutes

Configuration

Learn more about server configuration options

Riot API Docs

Official Riot Games API documentation

Get Started

Guides

Overview

Obtaining a Riot Games API Key

Configuring the API Key

Environment Variable Setup

How the API Key is Used

Rate Limiting

Development API Key Limits

Production API Key Limits

Handling Rate Limit Errors

Rate Limiting Best Practices

Implement Caching

Batch Requests

Monitor Usage

Implement Retry Logic

Security Best Practices

DO: Secure Practices

DON’T: Insecure Practices

Testing Authentication

Troubleshooting

Next Steps

API Overview

Quick Start

Configuration

Riot API Docs

Build docs developers (and LLMs) love

Get Started

Guides

​Overview

​Obtaining a Riot Games API Key

​Configuring the API Key

​Environment Variable Setup

​How the API Key is Used

​Rate Limiting

​Development API Key Limits

​Production API Key Limits

​Handling Rate Limit Errors

​Rate Limiting Best Practices

Implement Caching

Batch Requests

Monitor Usage

Implement Retry Logic

​Security Best Practices

​DO: Secure Practices

​DON’T: Insecure Practices

​Testing Authentication

​Troubleshooting

​Next Steps

API Overview

Quick Start

Configuration

Riot API Docs

Build docs developers (and LLMs) love

Overview

Obtaining a Riot Games API Key

Configuring the API Key

Environment Variable Setup

How the API Key is Used

Rate Limiting

Development API Key Limits

Production API Key Limits

Handling Rate Limit Errors

Rate Limiting Best Practices

Security Best Practices

DO: Secure Practices

DON’T: Insecure Practices

Testing Authentication

Troubleshooting

Next Steps