REST API

Authentication

Authenticate REST requests with an API key.

The REST API accepts Upscrape API keys as bearer tokens. API keys belong to an account and inherit that account's platform visibility, credit balance, rate limits, and credential access.

## Send the key

Include the key on every API request:

```http
Authorization: Bearer UPSCRAPE_API_KEY
```

```bash
curl --header "Authorization: Bearer $UPSCRAPE_API_KEY" \
  'https://data.upscrape.com/api/platforms'
```

Missing, malformed, revoked, or unknown keys return an authentication error. Do not retry authentication failures without changing the credential.

## Store keys safely

- Keep keys in a server-side secret manager or protected environment variable.
- Never embed a key in frontend JavaScript or a mobile binary.
- Never commit a `.env` file containing a key.
- Do not paste keys into tickets, chat, documentation, or agent prompts.
- Create separate keys for separate deployment environments and revoke keys that are no longer needed.

## Limit a key

A new key can do everything your account can. When you create one on the console's Access page, "Limit this key" narrows it:

- **What it can do:** browse the catalog (`catalog:read`), run requests (`execute`), read results (`jobs:read`), use MCP (`mcp`), see or manage monitors (`monitors:read`, `monitors:write`), and see or manage platform logins (`credentials:read`, `credentials:write`).
- **Platforms:** only the platforms you tick. Leave them all unticked to allow every platform.
- **Expires:** never, in 30 or 90 days, or on a date you choose. An expired key stops working like a revoked one.

The Access page lists each key's limits beside it. A request outside a key's limits returns `api_key_forbidden`.

## API keys and MCP OAuth

REST uses API keys. MCP accepts either an API key or an OAuth access token. Prefer OAuth for consumer connectors because the user authorizes the client without copying a long-lived API key into it.

The current MCP scope is `mcp`, which grants the connector the account access needed to use published capabilities at their published credit rates. A grant can be narrowed further with [scoped access](/docs/mcp/scoped-access): `mcp:read` for read-only use, and `platform:` and `capability:` allowlists that restrict a connector to what it actually needs.

## Authentication is not platform credentials

The Upscrape API key authenticates your Upscrape account. Some scraper capabilities also require credentials for the upstream platform. Those are stored separately through the [credentials API](/docs/api/credentials) and are never substituted for the bearer token.

The REST API accepts Upscrape API keys as bearer tokens. API keys belong to an account and inherit that account's platform visibility, credit balance, rate limits, and credential access.

Send the key

Include the key on every API request:

Authorization: Bearer UPSCRAPE_API_KEY

curl --header "Authorization: Bearer $UPSCRAPE_API_KEY" \
  'https://data.upscrape.com/api/platforms'

Missing, malformed, revoked, or unknown keys return an authentication error. Do not retry authentication failures without changing the credential.

Store keys safely

Keep keys in a server-side secret manager or protected environment variable.
Never embed a key in frontend JavaScript or a mobile binary.
Never commit a .env file containing a key.
Do not paste keys into tickets, chat, documentation, or agent prompts.
Create separate keys for separate deployment environments and revoke keys that are no longer needed.

Limit a key

A new key can do everything your account can. When you create one on the console's Access page, "Limit this key" narrows it:

What it can do: browse the catalog (catalog:read), run requests (execute), read results (jobs:read), use MCP (mcp), see or manage monitors (monitors:read, monitors:write), and see or manage platform logins (credentials:read, credentials:write).
Platforms: only the platforms you tick. Leave them all unticked to allow every platform.
Expires: never, in 30 or 90 days, or on a date you choose. An expired key stops working like a revoked one.

The Access page lists each key's limits beside it. A request outside a key's limits returns api_key_forbidden.

API keys and MCP OAuth

REST uses API keys. MCP accepts either an API key or an OAuth access token. Prefer OAuth for consumer connectors because the user authorizes the client without copying a long-lived API key into it.

The current MCP scope is mcp, which grants the connector the account access needed to use published capabilities at their published credit rates. A grant can be narrowed further with scoped access: mcp:read for read-only use, and platform: and capability: allowlists that restrict a connector to what it actually needs.

Authentication is not platform credentials

The Upscrape API key authenticates your Upscrape account. Some scraper capabilities also require credentials for the upstream platform. Those are stored separately through the credentials API and are never substituted for the bearer token.

Credit prices and plans: Upscrape pricing