Get and protect your API key

Your API key authenticates requests to Scrapeless. Treat it as a secret: anyone who obtains it may be able to use the services available to that key.

Get your key

1. Sign in to the Scrapeless dashboard.
2. Open the API key settings and copy the key you will use for your application. Some product guides refer to this value as an API token.
3. Store it in your local environment or your deployment platform’s secret store.

If you cannot locate the key settings, contact your account administrator or Scrapeless support. Do not send your password or an existing key in a support message.

Store it for local development

For Bash or Zsh, paste the key at a hidden prompt:

printf 'Scrapeless API key: '
read -rs SCRAPELESS_API_KEY
printf '\n'
export SCRAPELESS_API_KEY

This avoids including the literal key in the command you type. The variable lasts for the current shell session and is inherited by processes launched from it.

Check that it is set without printing its value:

if [ -n "${SCRAPELESS_API_KEY:-}" ]; then
  printf 'SCRAPELESS_API_KEY is set\n'
else
  printf 'SCRAPELESS_API_KEY is not set\n'
fi

If your project loads secrets from a .env file, exclude that file from version control before adding a key. Keep only empty variables or placeholders in a shared .env.example. A .env file requires an appropriate loader; creating it alone does not populate your process environment.

For deployed applications, configure the key in your hosting platform or CI/CD secret store and inject it at runtime. Limit access to the people and processes that need it.

Use the authentication method for your product

Python and Go SDKs are in development. Their setup and authentication instructions will be available in the Python SDK guide and Go SDK guide. Until then, use the authentication method documented for the REST endpoint you call.

For endpoints that use x-api-token, send the key without adding Bearer:

x-api-token: YOUR_API_KEY

A key embedded in a browser connection URL is still a secret. Redact the token value before logging, copying, or sharing the URL. For MCP clients, follow the configuration for the transport and client you use; environment variable names are not necessarily the same as the SDK’s.

CLI authentication — Coming soon

The CLI documentation will include Authentication and Configuration. Use that guide when the CLI is available to configure credentials for your terminal workflow. Keep credentials out of shared command examples, shell history, and logs.

Verify the key

Use the documented Get User Info endpoint to check authentication without submitting a scraping job:

curl --silent --show-error \
  --request GET 'https://api.scrapeless.com/api/v1/me' \
  --header "x-api-token: ${SCRAPELESS_API_KEY:?Set SCRAPELESS_API_KEY first}" \
  --output scrapeless-account.json \
  --write-out 'HTTP status: %{http_code}\n'

Inspect the status and response body locally. The response can include account and balance information, so do not publish the file or commit it to your repository.

Successful authentication confirms this request can use the key. Product access, balance, and request validity still need to be checked when you call a product endpoint. Continue with the Quickstart to make a Web Unlocker request.

Keep the key out of exposed surfaces

• Make authenticated calls from trusted server-side code. Do not embed the key in frontend JavaScript, mobile application bundles, or public configuration.
• Redact authentication headers, browser connection URLs, and secret environment variables from application logs and monitoring events.
• Avoid verbose HTTP traces or shell tracing while using real credentials. Environment variables can still be exposed through debugging tools and process inspection.
• Remove keys from screenshots, recordings, shared notebooks, support tickets, and AI chat prompts.
• Use your team’s approved secret-sharing method when access is necessary.

Replace a key safely

For a planned replacement, obtain a replacement key through the dashboard controls available to your account or through Scrapeless support. Update your secret store and all dependent applications, restart processes that load secrets at startup, and verify the replacement works. Then invalidate the old key and confirm it is no longer accepted.

If a key may have leaked, prioritize invalidating the exposed credential immediately, even if this interrupts running applications. Use the available dashboard controls or contact support for help, then distribute a replacement through your secret store.

Removing a key from a file or deleting a public post does not invalidate it. Review recent usage and clean up exposed copies, including logs and repository history, after containing the exposure.

Troubleshoot authentication

If authentication fails, confirm that the application loaded the intended variable, the key has no surrounding whitespace, and the credential is being sent using the method required by that endpoint. Restart long-running processes after changing their secret configuration.

If the key works on the verification endpoint but a product request fails, inspect the product error response and dashboard access. Share only redacted diagnostics when requesting support.

Next: Make your first request or choose a product.