Authentication

Every API request carries an API key. The key belongs to your account: it spends the account's credits and can reach the platforms the account can.

Get a key

Open the console and create a key. It is shown once, so copy it then. An account can have up to 25 active keys; create one per app or environment so you can revoke one without touching the others.

Send it

Send the key as a bearer token on every request:

Authorization: Bearer UPSCRAPE_API_KEY

For example, this lists the platforms the key can use:

curl https://data.upscrape.com/api/platforms \  -H "Authorization: Bearer $UPSCRAPE_API_KEY"

A missing, wrong or revoked key gets HTTP 401 with unauthorized. Retrying won't help; fix the key.

Keep it secret

• Keep keys on your server: in a secret manager or an environment variable.

• Never put a key in browser JavaScript, a mobile app, Git, a ticket or a prompt you give an AI agent.

• Revoke a key in the console the moment you no longer need it, or think it leaked. Revoking takes effect at once.

Limit a key

A new key can do everything your account can. When you create one, you can narrow it:

• What it can do. For example, run endpoints (execute), read results (jobs:read), browse the catalog (catalog:read), use MCP (mcp), or read and manage monitors (monitors:read, monitors:write).

• Which platforms. Only the platforms you tick; none ticked means every platform.

• When it expires. Never, in 30 or 90 days, or on a date you choose. An expired key stops working like a revoked one.

A request outside a key's limits gets HTTP 403 with forbidden.

Keys and AI agents

An AI app connecting over MCP can sign in with your Upscrape account instead of using a key, so there is no key to paste into it. Use a key over MCP only where an app or server cannot open a browser; Connect with an API key shows how.