About LeagueLocker
Supported platforms
LeagueLocker is read-only by design: to set lineups, make trades or claim players, tap Manage and we open the league in its own app.
Username only. Every league, standings, live matchups, rosters with injuries, transactions, Chopped/guillotine status.
Survivor & Pick'em pools are included. Only the current week's picks need the optional Sleeper sign-in.
Verified: Yes — NFL (redraft + Chopped). NBA uses the same endpoints; not yet tested on a real NBA league.
League URL or ID. Standings, live matchups with projections, roster with injuries, transactions.
Private leagues need your espn_s2 + SWID cookies.
Verified: Yes — NFL public league. Other sports use the same API; roster slot labels for MLB/NHL are best-effort.
League URL or ID. Standings, live scoring, rosters with injuries, transactions.
Private leagues need an MFL API key (from the league's Help → Developer API page).
Verified: Yes — public 2026 league.
League URL or ID. Standings and rosters via Fantrax's official read-only API.
Fantrax's public API has no live matchup scores or transactions; the league must be viewable.
Verified: Yes — public 2026 MLB league (standings + rosters).
League URL + the league token from your signed-in CBS page (one-click bookmark helper).
CBS retired its developer program. Tokens are copied from your browser and expire.
Verified: Partly — CBS's API host and auth check respond; full data path needs a real token (not yet tested).
Sign in with Yahoo (OAuth 2.0).
Needs a registered Yahoo developer app on the server. Track manually for now.
Verified: No — OAuth flow scaffolded only.
NFL Fantasy stopped running season-long leagues in 2026; leagues migrated to ESPN.
Connect the migrated league through ESPN.
Verified: n/a
Best ball drafts & tournaments.
No public API. Track entries manually with a deep link.
Verified: n/a
DFS contests & best ball.
No public API for user entries. Track manually.
Verified: n/a
DFS contests.
No public API for user entries. Track manually.
Verified: n/a
Comes with your Sleeper username: alive/eliminated, week out, teams used, entrants left, pick'em points and rank.
Sleeper hides the current week's picks until kickoff unless you add the optional Sleeper sign-in (a full-account token kept only in your browser).
Verified: Yes (public data): a real 24-entry survivor pool. Status, used teams, past picks and standings come from Sleeper's public API with just a username. This week's picks via the optional sign-in: built against the documented query shape, not yet tested with a real sign-in.
ESPN's pick'em and survivor games.
No documented API. Track manually.
Verified: n/a
Survivor and pick'em pools.
No public API. Track manually.
Verified: n/a
Has a public read API — next adapter on the roadmap.
Track manually for now.
Verified: No
Privacy. LeagueLocker is read-only and isn't affiliated with any of the platforms listed. There are two ways to use it:
Without an account, your connections live only in your browser's local storage. When you load the dashboard they're sent to this site's server only to call the platform for you, and nothing is saved there.
With an account, we store your email, an optional display name, a salted PBKDF2 hash of your password (never the password itself), your connections and preferences, and your sign-in sessions, in a Cloudflare D1 database. Platform secrets (CBS and Sleeper tokens, ESPN cookies, MFL API keys) are encrypted with AES-256-GCM before they're stored. They're only decrypted on the server to call that platform, and they're never sent back to your browser or written to logs. Session cookies are HttpOnly, Secure and SameSite=Lax, and you can sign out of every device at once.
Deleting your account (Account → Delete account) immediately removes your account, every connection and token, and all sessions. We don't sell or share your data, use it for ads, or send email (password reset by email isn't available yet).