The CSGO Premier API is a read-only JSON API over HTTPS. It serves the same public data you see on the site: seasons, leaderboards, player profiles, per-season player stats, match results and maps.

Base URL

https://public-api.csgopremier.com/v1

• Every endpoint is a GET and returns JSON (application/json; charset=utf-8).
• Field names are camelCase. Timestamps are ISO 8601 in UTC (2026-11-05T18:30:00Z).
• Responses are compressed when you send Accept-Encoding: gzip.
• GET /v1/status and GET /v1/openapi.json work without a key. Everything else needs one.

The API only contains data produced on CSGO Premier itself. It never includes third-party statistics or private account data such as email addresses, payments or IP addresses.

API keys are issued per app, after a short review by staff.

1. Request access on the Developers page while signed in. Describe what you are building, roughly how many requests you expect and whether you call the API from a server or a browser. This opens a support ticket with your answers.
2. Staff review the request. We may ask questions in the ticket. When approved, we set your rate limits and issue a key.
3. Reveal your key on the Developers page. It is shown once: copy it straight into your secret store. Only a hash is kept on our side, so nobody, staff included, can show it to you again.

Each app has at most one live key. If you lose it or think it leaked, ask in your ticket and staff issue a new one; the old key stops working immediately. You can't create keys yourself.

On the Developers page you can always see your app's status, limits and the last 14 days of usage, and edit its allowed origins, allowed IPs, name, description and website.

Send your key with every request, in either header:

Authorization: Bearer cpk_your_key_here

X-API-Key: cpk_your_key_here

Keys start with cpk_. Never put a key in a URL or query string: URLs end up in logs, browser history and referrer headers. A request with a key-like query parameter (key, api_key, apikey, token, access_token) is refused with 400 bad_request. If you ever sent your key that way, ask for a new one.

• Keep the key on your server. Store it in an environment variable or a secret manager, never in a repository, a mobile app or public JavaScript.
• Browser apps should call your own backend, which calls this API. If you must call the API straight from a browser, restrict the key to your website's origins (see below) and accept that the key is visible to anyone who opens the developer tools.
• A request without a valid key gets 401 unauthorized. A key whose app is suspended gets 403 forbidden.

Two allow-lists limit where your key works. Edit both on the Developers page; changes apply within a minute.

Allowed origins apply to browser requests, which carry an Origin header. A browser request is only accepted when its origin is on the list, so an empty list means server-side use only: every request with an Origin header is refused with 403 origin_not_allowed. Server-side requests (no Origin header) are not affected by this list. Error responses still carry CORS headers, so your page can read the error.

• Format: scheme://host[:port], no path and no trailing slash.
• https://example.com matches only that host. https://*.example.com matches any subdomain (not example.com itself).
• Plain http:// is only accepted for localhost and 127.0.0.1, for local development.
• Up to 20 origins.

Allowed IPs apply to every request. An empty list allows any address; once it has entries, requests from other addresses get 403 ip_not_allowed. Use single addresses (203.0.113.10) or CIDR ranges (203.0.113.0/24, IPv4 /8 or narrower, IPv6 /32 or narrower). Up to 20 entries. This is the strongest protection for a server-side key: a leaked key is useless from anywhere else.

Origins are a browser safeguard, not authentication: a script can send any Origin header it likes. Keep the key secret either way.

CORS preflight (OPTIONS) requests are always answered, allowing the Authorization, X-API-Key and If-None-Match headers and caching the answer for a day. Requests never use cookies or credentials.

Every app has three limits, set by staff when the app is approved and shown on the Developers page:

Every authenticated response tells you where you stand:

When you go over a limit you get 429 with a Retry-After header (seconds):

• rate_limited: too fast. Wait Retry-After seconds, then continue.
• quota_exceeded: the daily quota is used up. Retry-After points at the next UTC midnight.

Requests that fail authentication are limited per IP address instead, to stop key guessing. If the service is under heavy load it may answer 503 overloaded with Retry-After; treat it like a 429.

Back off properly. Honor Retry-After. For repeated 429, 503 or network errors, retry with exponential backoff and jitter (for example 1s, 2s, 4s, 8s, each plus a random 0–1s, capped at 60s), and stop after a few attempts. Never retry 4xx errors other than 429: they won't succeed.

Need more? Ask in your support ticket with your current usage and why. Limits are per app; creating extra accounts or apps to get around them gets all of them suspended.

Most data changes slowly. Caching on your side keeps you well inside your limits and makes your app faster.

• Responses carry Cache-Control: public, max-age=N saying how long the data is good for. Typical values: seasons and maps 5 minutes, leaderboards and profiles about a minute, finished matches an hour or more.
• Responses carry an ETag. Send it back as If-None-Match; if nothing changed you get an empty 304 Not Modified, which is cheap for both sides. A 304 still counts as a request.
• Leaderboards and ranks are rebuilt about every 60 seconds. Polling them more often returns the same data. Each leaderboard response includes meta.generatedAt.
• Finished matches never change: cache them for as long as you like.
• For a bot answering many users, cache each player for at least a minute rather than calling the API for every message.

Lists use cursor pagination.

• limit sets the page size: default 25, maximum 100.
• The response's meta.nextCursor is an opaque string. Pass it as cursor to get the next page. Keep the other parameters the same.
• When meta.nextCursor is null you've reached the end.
• Cursors are not meant to be built or edited by hand, and may expire after a while; start again from the first page if one is rejected.

{
  "data": [ { "rank": 1, "rating": 41250 } ],
  "meta": { "nextCursor": "eyJvIjoxMDB9", "generatedAt": "2026-11-05T18:30:00Z" }
}

Look up many players in one request instead of one request per player:

GET /v1/players?steamIds=76561198000000001,76561198000000002
GET /v1/players?ids=12,345,6789
GET /v1/players?username=PlayerName

• Up to 50 IDs per request, comma-separated.
• Unknown IDs are left out of data rather than failing the whole request; meta.notFound lists them.
• username matches the current username, case-insensitively. Usernames can change, so store the numeric id or the Steam ID, not the name.

Errors use standard HTTP status codes and one JSON shape:

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Retry after 12 seconds.",
    "requestId": "01JC4Q1S8M8Q7R2W3X4Y5Z6A7B"
  }
}

Branch on code, not on message: messages may be reworded. Every response has an X-Request-Id header; include it when you report a problem in your support ticket.

• Games. CS:GO and CS2 have separate ratings. Endpoints that depend on the game take ?game=csgo (default) or ?game=cs2.
• Seasons are addressed by their number (/v1/seasons/5) or current. Only active and ended seasons are listed. Trophy images are absolute URLs.
• Ratings and placement. A player's rating is null and placed is false until they win their 6 placement matches in that season and game.
• Ranks are positions in the season leaderboard. Banned players are left out, so past-season ranks can shift slightly when someone is banned later.
• CS2 has ratings, wins and matches, but no kill, damage or headshot stats. ADR for CS:GO is only available for matches played since 19 June 2026; earlier seasons return null there.
• Matches. Only finished matches are available. Live or unfinished matches return 404.
• Deleted accounts return 404 and don't appear on leaderboards.
• Bans. Profiles include banned: true while a matchmaking ban is active (short cooldowns don't count). Ban reasons are not part of the API.
• Rates such as winRate and headshotRate are fractions from 0 to 1, not percentages.
• Premium. premiumTier is none, basic, premium or max. Expiry dates are not part of the API.
• Deleted players in matches. A finished match keeps the stats of a player who later deleted their account, with player set to null.
• IDs. Player id is our stable numeric ID. steamId is the Steam64 ID as a string (it doesn't fit safely in a JavaScript number). Usernames can change.

• Proxy through your server. Keep the key server-side and let your own backend cache and serve your users.
• Cache first. Respect Cache-Control, use ETag / If-None-Match, and never poll faster than the data changes.
• Back off. Honor Retry-After, use exponential backoff with jitter and cap your retries.
• Batch. Use /v1/players?ids= or ?steamIds= instead of many single lookups.
• Identify yourself. Send a descriptive User-Agent with a way to reach you, e.g. PremierStatsBot/1.2 (+https://example.com; discord: yourname).
• Don't scrape or enumerate. Don't walk through ID ranges or mirror whole datasets. Request what your users actually look at.
• Respect players. Show data in context, don't build tools to track, harass or expose individuals, and honor a player's request to be removed from your app.
• Attribute. Show "Data from csgopremier.com" with a link to https://csgopremier.com wherever the data appears.
• Expect additions. Ignore fields you don't know; new fields can appear at any time.

curl

curl -s "https://public-api.csgopremier.com/v1/players/steam/76561198000000001" \
  -H "Authorization: Bearer $CSGOPREMIER_API_KEY" \
  -H "User-Agent: MyBot/1.0 (+https://example.com)"

JavaScript (Node 18+, server-side) with an ETag cache and backoff:

const BASE = "https://public-api.csgopremier.com/v1";
const cache = new Map(); // url -> { etag, body }

async function premier(path, attempt = 0) {
  const url = BASE + path;
  const cached = cache.get(url);
  const res = await fetch(url, {
    headers: {
      Authorization: `Bearer ${process.env.CSGOPREMIER_API_KEY}`,
      "User-Agent": "MyBot/1.0 (+https://example.com)",
      ...(cached ? { "If-None-Match": cached.etag } : {}),
    },
  });

  if (res.status === 304 && cached) return cached.body;

  if ((res.status === 429 || res.status === 503) && attempt < 4) {
    const retryAfter = Number(res.headers.get("Retry-After")) || 2 ** attempt;
    const jitter = Math.random() * 1000;
    await new Promise((r) => setTimeout(r, Math.min(retryAfter * 1000 + jitter, 60_000)));
    return premier(path, attempt + 1);
  }

  const body = await res.json();
  if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message}`);

  const etag = res.headers.get("ETag");
  if (etag) cache.set(url, { etag, body });
  return body;
}

const { data: player } = await premier("/players/steam/76561198000000001");
console.log(player.username, player.ratings.csgo?.rating);

Python with requests:

import os, random, time
import requests

BASE = "https://public-api.csgopremier.com/v1"
session = requests.Session()
session.headers.update({
    "Authorization": f"Bearer {os.environ['CSGOPREMIER_API_KEY']}",
    "User-Agent": "MyBot/1.0 (+https://example.com)",
})

def premier(path, params=None, attempts=4):
    for attempt in range(attempts):
        res = session.get(BASE + path, params=params, timeout=10)
        if res.status_code in (429, 503):
            wait = float(res.headers.get("Retry-After", 2 ** attempt))
            time.sleep(min(wait + random.random(), 60))
            continue
        res.raise_for_status()
        return res.json()
    raise RuntimeError("gave up after retries")

# Walk a full leaderboard page by page.
cursor, rows = None, []
while True:
    page = premier("/seasons/current/leaderboard",
                   {"game": "csgo", "limit": 100, **({"cursor": cursor} if cursor else {})})
    rows += page["data"]
    cursor = page["meta"]["nextCursor"]
    if not cursor:
        break
print(len(rows), "ranked players")

• The current version is v1, in the URL path. It is stable.
• Additive changes (new endpoints, new fields, new optional parameters, new error codes) can ship at any time without notice. Write clients that ignore unknown fields.
• Breaking changes (removing or renaming fields, changing types or meanings) only happen in a new version such as /v2. The old version keeps working for at least 90 days after the new one is announced, and deprecated responses carry Deprecation and Sunset headers.
• Changes are announced on this page and in the support tickets of active apps.

By requesting a key and using the API you agree to these terms, in addition to the site's Terms of Service and Privacy Policy.

1. Attribution. Show "Data from csgopremier.com" with a link to https://csgopremier.com wherever the data is displayed.
2. No reselling. Don't sell, license or redistribute the raw data or bulk copies of it. Building a product or service on top of it is fine.
3. No impersonation. Don't present your app as made, endorsed or run by CSGO Premier, and don't use our logo in a way that suggests it.
4. No harm to players. Don't use the data to harass, dox, stalk or discriminate against players, or combine it with other sources to identify people beyond what they show publicly.
5. Respect the limits. Don't get around rate limits or quotas with extra accounts, apps or keys, and don't scrape the website instead of using the API.
6. Keep keys secret. You're responsible for everything done with your key. Tell us at once if it leaks.
7. Suspension. We can change limits, suspend or revoke a key or app at any time, especially for abuse, security issues or load problems, with or without notice.
8. As is. The API and data are provided as is, without warranty or guaranteed uptime. We may change or end the API under the versioning policy above.

Questions about the terms go in your support ticket.