Getting started

API keys

Your API key identifies your account on every request. Create and manage keys from your dashboard; send the key in the X-Api-Key header.

Key format

Keys are prefixed so you can tell environment at a glance. A live key runs real extractions and spends credits; a test key returns realistic sandbox data for free.

Examples

# production
ak_live_7f3a…9nT
# sandbox
ak_test_2b8c…4kQ

Using a key

Load the key from the AURACRAWL_API_KEY environment variable and pass it in the X-Api-Key header — see Authentication.

Header

X-Api-Key: $AURACRAWL_API_KEY

Test vs live

	ak_test_…	ak_live_…
Targets	Sandbox fixtures — no real fetches	Real sites
Credits	Free	Metered against your plan
Use for	Local dev, CI, demos	Production workloads

Sandbox responses match the live schema exactly, so code written against a test key runs unchanged in production — only the key changes.

Scopes

Give each key only what it needs. A key can be scoped to read-only, or narrowed to specific connectors or destinations, so a leaked pipeline key can't reach anything it wasn't meant to.

Scope	Grants
`extractions:read`	Read extraction status and results.
`extractions:write`	Create extraction jobs.
`connectors:read`	List and read connector configuration.
`destinations:write`	Write results to configured destinations.

Rotation & revocation

You can hold several active keys at once, so rotation is zero-downtime: create a new key, roll it out, then revoke the old one once it stops being used. Revoking takes effect on the next request.

Tip. Use one key per service (e.g. prod-worker, ci-tests) so you can revoke narrowly without taking everything down.

Keeping keys safe

Server-side only — never ship a key in a browser, mobile app, or public repo.
Load from AURACRAWL_API_KEY (a secret manager or a git-ignored .env), never hard-coded.
Prefer read-only and connector-scoped keys where possible.
Rotate immediately if a key is ever exposed.

Webhook signing

Webhooks we send back to you are signed with a separate signing secret (whsec_…), not your API key — so you verify authenticity without exposing the key. See Delivery & webhooks.