Since the company’s founding a free and open API has been a foundational feature of RunSignup / TicketSignup. The RunSignup API has enabled timers, race directors, developers, and partners to build thousands of integrations on top of our platform — everything from results systems, fundraising leader boards, custom event calendars and dashboards, etc. Our API will remain free and open.
However, the environment around offering open APIs has changed dramatically over the past couple of years. RunSignup needs to respond to protect the infrastructure so that legitimate uses can continue uninterrupted. To that end, beginning January 1, 2027, all users of the RunSignup API will be required to register as an API Caller. Registration is free, takes about a minute, and requires only a small change to your existing API calls.
What is Driving This Change?
With the rapid rise of AI, RunSignup is regularly experiencing malicious as well as accidental attacks directed at our infrastructure. Aggressive bot attacks, automated traffic from AI crawlers, scrapers and outright targeted attacks have grown enormously. AI vibe coding products have given way to legitimate users building apps with no regard for rate limiting their calls. All of these vectors have increased the load on our infrastructure which consumes real capacity that should be serving our customers, athletes, participants and legitimate API users.
Today, when an unidentified caller misbehaves, our only options are blunt ones that risk impacting valid integrations. Our new API Caller Registration process gives every consumer an identity. That lets us apply per-consumer rate limiting, quickly identify and block bad actors without disrupting anyone else, and — just as importantly — contact and support legitimate users when we see an issue with their calls or when changes are coming that affect them.
We wrote about these challenges in a recent Founder’s Corner article Evolving our Free Model. The spirit here is the same: we want to keep offering free and open tools, and we’re asking the community to help us protect the shared infrastructure that makes them possible. Registration is how we keep the API free and open for everyone — for the good of the whole community.
What Is (and Isn’t) Changing
- The API remains free and open — registration costs nothing.
- Your existing API keys continue to work and are still required. API caller registration is in addition to your current authentication (API keys or OAuth), not a replacement for it. Registration identifies who is calling; your API keys still control what you can access.
- Starting January 1, 2027, API calls without a valid API caller registration token will be rejected.
What You Need to Do Before January 1, 2027
This applies to you if you are currently using the RunSignup/TicketSignup API. (If you are consuming the API indirectly via our Zapier integration, there is no action at this time. Changes to the Zapier Apps will be published in about a month. Keep an eye on the RunSignup blog for more information on Zapier.)
There are three steps: register as an API caller, get your registration token and secret, and add them to your API calls.
Step 1: Register as an API Caller
Log in to your RunSignup account and go to the API Keys page in the API documentation. At the top you’ll see the API Caller Registration section — click Register as an API caller.
Note the callout on that page: API caller registration is not the same as your authentication to the API. You still need to use OAuth or API keys to access your race, events, etc.
On the registration page, provide a descriptive intended usage summary. Then press Create API Caller button.
Step 2: Get Your Registration Token and Secret
Once created, your new API caller will appear in the table on this page with its API caller token (`rsu_api_reg`) and registration secret (`X-RSU-API-REG-SECRET`). These are tied to your RunSignup user account and work across all APIs.
Be sure to record your API caller secret password in a secure location. This will be the only time it is displayed.
Step 3: Add the Token and Secret to Your API Calls
Modify your existing API calls to include both values:
– Send your registration token as an HTTP GET parameter named `rsu_api_reg`
– Send your registration secret as an HTTP header named `X-RSU-API-REG-SECRET`
For example, a call to the Get Race Participants API that looks like this today:
GET
https://runsignup.com/Rest/race/:race_id/participants?api_key=YOUR_KEY&api_secret=YOUR_SECRET
would become:
GET https://runsignup.com/Rest/race/:race_id/participants?api_key=YOUR_KEY&api_secret=YOUR_SECRET&rsu_api_reg=YOUR_REG_TOKEN
Header: X-RSU-API-REG-SECRET: YOUR_REG_SECRET
Again — keep your existing API keys in place. Only the registration token and secret are being added. You only need to register once to access all APIs. The account you use to register your API should be protected by MFA. (See How to Enable MFA for Your Profile)
Every API method’s documentation now includes an API Caller Identification section showing exactly where these parameters go.
Don’t Wait Until January
You can register and add the token to your calls today — the API accepts registered calls now. We encourage everyone to make this change well before the January 1, 2027 deadline so there’s no interruption to your integration.
RunSignup is also making these exact changes to our own apps that connect to the RunSignup platform: RaceDay Scoring, RaceDay Checkin, RaceJoy, RaceDay Mobile, RaceDirector and TicketCheckin, are all being by the RunSignup team to be registered API Callers.
The Zapier Apps used for easy integration will also be subject to this change. If you are a user of the Zapier RunSignup or Zapier TicketSignup App, keep an eye on our blog for additional updates concerning those integration points.
If you have questions about registration or need help updating your integration, reach out to us at info@runsignup.com. We’re happy to help — supporting legitimate users of our API is exactly what this change is designed to enable.