JWT authentication (Stock Provider)

The stock data provider (dataProvider: 'stock') requires a jwt widget prop. For widget setup, see Stock Provider.

#What a JWT is

A JSON Web Token (JWT) is a compact, signed string (RFC 7519) made of three parts:

Sportradar holds your matching public key. When the widget calls Sportradar custom bet services for offering or odds calculation, those services verify the signature on the token you provide. That replaces exposing a long-lived UOF API key in the browser while still authenticating traffic from your integration.

For Custom Bet stock you:

1. Sign a fresh token on your backend after the user is authenticated (never in client-side JavaScript).
2. Pass the resulting string to the widget as the jwt prop.
3. The widget sends it on each custom bet request as a bearer token:

Authorization: Bearer <your-jwt>

The token is not a static password you embed in the page. Issue short-lived tokens and fetch a new one when validation fails or your session policy requires a refresh.

#Why stock uses a JWT (instead of UOF Proxy)

With uofProxy, your page implemented callbacks that called your proxy with a UOF API key and returned XML to the widget.

With stock, the widget calls Sportradar-hosted custom bet APIs directly. The jwt replaces that server-side UOF key for custom bet traffic: it authorizes the widget runtime to load markets and calculate odds for the current user session.

#How the token reaches the widget

Typical integration pattern:

1. User logs in to your site as usual.
2. Your frontend calls a same-origin endpoint (for example GET /api/custom-bet/jwt) that only returns a token for authenticated users.
3. Your backend signs a token with RS256 using the private key that matches your published public key, and returns { "jwt": "…" }.
4. Pass the string to SIR('addWidget', …, 'customBet', { jwt, dataProvider: 'stock', … }).
5. Refresh the token when it expires or when custom bet requests start failing with 401/403.

#Prerequisites (one-time setup)

Work with Sportradar client setup before production:

If you already use widget JWT signing for other Sportradar products, you can usually reuse the same key pair and signing code; confirm with client setup that the published key covers Custom Bet stock.

Non-production environments: follow Non-Production Environments in the shared JWT tutorial when you use separate dev or staging keys.

#Sign tokens on your backend

Use the same RS256 signing flow as other Sportradar widget JWT integrations. Your JWT library builds the payload and signature; follow client setup guidance for payload fields and token lifetime.

Example (Node.js) — adjust the payload to match your Sportradar onboarding:

import jwt from "jsonwebtoken";
import fs from "fs";

const privateKey = fs.readFileSync("rsa-private.pem", "utf8");

const token = jwt.sign(
  {
    /* payload per your Sportradar JWT onboarding */
  },
  privateKey,
  { algorithm: "RS256", expiresIn: "1h"

More examples and key rotation: JSON Web Token (JWT) tutorial.

#Pass the JWT to Custom Bet

SIR("addWidget", "#sr-widget", "customBet", {
  matchId: 50852263,
  dataProvider: "stock",
  jwt: customBetJwt, // from your backend endpoint
  dataProviderConfig: {
    addToBetSlip,
  },
});

The jwt prop is only required when dataProvider is 'stock'. Legacy uofProxy integrations do not use it.

#Compared to UOF Proxy authentication

#Troubleshooting

See also Stock Provider troubleshooting.

#Related documentation

• Stock Provider — full stock integration
• Migrating from UOF Proxy to Stock — moving off uofProxy
• JSON Web Token (JWT) — key generation, signing examples for other widgets, key rotation