import.io Authentication: Methods & Security Best Practices (2026)

Authentication overview

import.io provides web data extraction services, offering both a platform for managed data extraction and a programmatic API for integrating extracted data into other systems. Authentication for import.io ensures that all interactions with its API and platform are authorized, protecting user data and intellectual property. The primary methods for authentication include API keys for direct programmatic access and OAuth 2.0 for applications requiring delegated access to user accounts.

The choice of authentication method depends on the integration scenario. API keys are suitable for server-to-server communication where an application directly accesses its own import.io resources. OAuth 2.0 is designed for scenarios where a third-party application needs to access a user's import.io account on their behalf, without directly handling their credentials. This distinction aligns with common industry practices for securing web services, as detailed in the OAuth 2.0 Authorization Framework specification.

Supported authentication methods

import.io supports standard authentication protocols to secure access to its platform and API. The main methods available are:

API Keys

API keys are unique identifiers used to authenticate requests to the import.io API. When an API key is generated, it is associated with a specific user or application within the import.io platform. This key must be included in each API request, typically in the request header or as a query parameter, to verify the sender's identity and authorization to access the requested resources. API keys provide a straightforward method for server-side applications to authenticate and are generally recommended for direct integration where the application itself is the primary actor.

OAuth 2.0

OAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to a user's resources on an HTTP service, without exposing the user's credentials. import.io leverages OAuth 2.0 for scenarios where an application needs delegated access to a user's import.io account. This method involves a user granting permission to an application, which then receives an access token. This access token is used to make API requests on behalf of the user, with permissions limited by the scope granted during the authorization process. OAuth 2.0 is particularly useful for building integrations that require user consent and access to specific user-scoped data, as described in the OAuth 2.0 documentation.

The following table summarizes the key characteristics of each authentication method:

Getting your credentials

Accessing the import.io API requires obtaining the appropriate credentials. The process for generating API keys and setting up OAuth 2.0 clients typically involves interacting with the import.io platform's user interface.

API Key generation

1. Log in to the import.io platform: Navigate to the import.io homepage and log in to your account.
2. Access API settings: Within the platform dashboard, locate the section related to API access or developer settings. This is usually found under 'Account Settings' or a dedicated 'API' menu item.
3. Generate new API key: Follow the prompts to generate a new API key. The platform may allow you to name your key for easier management or assign specific permissions to it.
4. Securely store the key: Once generated, the API key will be displayed. It is crucial to copy this key immediately and store it in a secure location, as it may not be retrievable again for security reasons. Treat API keys as sensitive as passwords.

OAuth 2.0 client setup

For OAuth 2.0 integrations, you will need to register your application with import.io to obtain a Client ID and Client Secret:

1. Register your application: In the import.io developer console or API settings, find the option to register a new application.
2. Provide application details: You will typically need to provide details such as your application's name, description, and importantly, the redirect URI (or callback URL). This is the URL where import.io will send the user back after they authorize your application.
3. Obtain Client ID and Secret: Upon successful registration, import.io will issue a Client ID and Client Secret. The Client ID is public and identifies your application, while the Client Secret is confidential and must be kept secure.
4. Configure scopes: Define the necessary API scopes that your application requires. Scopes limit the access an application has to a user's data, adhering to the principle of least privilege.

Authenticated request example

Once you have obtained your API key, you can use it to make authenticated requests to the import.io API. Here's an example of how to include an API key in a common HTTP request using curl, assuming the API key is passed in an Authorization header:

curl -X GET \
  'https://api.import.io/v4/extractor/YOUR_EXTRACTOR_ID/data?_apikey=YOUR_API_KEY' \
  -H 'Accept: application/json'

In this example:

• YOUR_EXTRACTOR_ID should be replaced with the specific ID of the extractor you wish to query.
• YOUR_API_KEY should be replaced with your actual import.io API key.
• The _apikey query parameter is a common method for API key transmission, though some APIs might prefer a custom header like X-API-Key or an Authorization: Bearer token. Always refer to the specific import.io API documentation for the exact method of key inclusion.

For OAuth 2.0, after obtaining an access token, requests are typically made by including the token in an Authorization header:

curl -X GET \
  'https://api.import.io/v4/user/profile' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Accept: application/json'

Here, YOUR_ACCESS_TOKEN is the token acquired through the OAuth 2.0 flow. This standard practice is widely adopted across APIs, including those from major providers like Google's OAuth 2.0 implementation.

Security best practices

Implementing strong security practices for authentication is crucial to protect your data and maintain the integrity of your integrations with import.io. Adhering to these guidelines helps mitigate common security risks:

API Key management

• Keep API keys confidential: Never expose API keys in client-side code, public repositories, or unsecured environments. Treat them with the same level of confidentiality as passwords.
• Use environment variables: Store API keys in environment variables rather than hardcoding them directly into your application code. This prevents keys from being committed to version control systems.
• Rotate keys regularly: Periodically generate new API keys and revoke old ones. This practice limits the window of exposure if a key is compromised.
• Restrict key permissions: Where possible, assign the minimum necessary permissions to each API key. If a key is compromised, the damage will be limited to the specific resources it has access to.
• Monitor API key usage: Regularly review API logs for unusual activity or excessive requests that might indicate a compromised key.

OAuth 2.0 implementation

• Validate redirect URIs: Ensure that your registered redirect URIs are specific and secure. Only allow redirects to URIs under your control to prevent authorization code interception attacks.
• Secure Client Secrets: Treat your OAuth Client Secret with the same confidentiality as an API key. It should never be exposed in client-side code.
• Use PKCE for public clients: For mobile and single-page applications (public clients), implement the Proof Key for Code Exchange (PKCE) extension to OAuth 2.0. PKCE adds an additional layer of security to prevent authorization code interception.
• Refresh token security: If using refresh tokens, store them securely and revoke them if suspicious activity is detected. Refresh tokens should have a limited lifetime and be rotated.
• Scope management: Request only the necessary scopes from users. Over-requesting permissions can deter users and increase the attack surface if your application is compromised.

General security considerations

• Use HTTPS: Always ensure all communication with the import.io API occurs over HTTPS to encrypt data in transit and prevent eavesdropping.
• Implement rate limiting: If your application is publicly accessible, implement rate limiting to prevent abuse and denial-of-service attacks against your integration.
• Error handling: Implement robust error handling that does not reveal sensitive information in error messages, especially in production environments.
• Regular security audits: Conduct periodic security audits of your application and infrastructure to identify and address potential vulnerabilities.