ScraperApi Authentication: API Key Integration (2026)

Authentication overview

ScraperApi employs a straightforward authentication model centered around a unique API key. This key acts as your credential for accessing the service, allowing you to route web scraping requests through ScraperApi's infrastructure. Each request you send must include this API key for successful processing. The system uses this key to identify your account, apply your subscription's usage limits, and manage concurrent requests. This approach simplifies integration while maintaining necessary security and accountability for API usage.

Unlike more complex authentication flows such as OAuth 2.0, which often involve multiple steps for token issuance and refresh, ScraperApi's API key method is designed for direct and efficient integration, particularly suitable for automated scraping tasks where a consistent, static credential is practical. For detailed information on ScraperApi's API functionality, refer to the official ScraperApi documentation.

Supported authentication methods

ScraperApi primarily supports API key authentication. This method is standard for many web services that require client identification without involving user delegation or complex authorization scopes. The API key is typically passed as a query parameter in your API requests.

While API keys are effective for identifying the client making a request, they differ from authentication mechanisms like OAuth 2.0's authorization grants, which are designed for delegated authorization (e.g., a user granting a third-party application access to their resources without sharing their primary credentials). For ScraperApi, your API key directly authenticates your application as the principal making the request.

The following table summarizes the primary authentication method:

Getting your credentials

Your API key is generated automatically when you create a ScraperApi account. You can locate and retrieve your API key from your ScraperApi dashboard. This key is unique to your account and should be treated as a sensitive credential.

To obtain your ScraperApi API key:

1. Sign up or Log in: Navigate to the ScraperApi website and either create a new account or log in to your existing one.
2. Access Dashboard: Once logged in, you will be directed to your user dashboard.
3. Locate API Key: Your unique API key is typically displayed prominently on the dashboard. It's often labeled as API Key or similar.

ScraperApi provides a documentation page with specific instructions and examples for integrating your API key into various programming languages. Always ensure you are logged into your official ScraperApi account to access your legitimate API key.

Authenticated request example

To authenticate a request with ScraperApi, you include your API key as a query parameter named api_key. The basic structure of a request involves sending your target URL through ScraperApi's endpoint, with the API key appended.

Below are examples in Python and Node.js, demonstrating how to construct an authenticated request to scrape a hypothetical target URL (https://example.com). These examples utilize common HTTP client libraries for simplicity and clarity.

Python example

This Python example uses the requests library to make a GET request to ScraperApi, passing the API key and the target URL.

import requests

API_KEY = 'YOUR_API_KEY'  # Replace with your actual API key
TARGET_URL = 'https://example.com' # The URL you want to scrape

def scrape_with_scraperapi(api_key, target_url):
    payload = {'api_key': api_key, 'url': target_url}
    try:
        response = requests.get('http://api.scraperapi.com/', params=payload)
        response.raise_for_status() # Raise an HTTPError for bad responses (4xx or 5xx)
        print(f"Status Code: {response.status_code}")
        print(response.text[:500]) # Print first 500 characters of the response
    except requests.exceptions.HTTPError as err_h:
        print(f"Http Error: {err_h}")
    except requests.exceptions.ConnectionError as err_c:
        print(f"Error Connecting: {err_c}")
    except requests.exceptions.Timeout as err_t:
        print(f"Timeout Error: {err_t}")
    except requests.exceptions.RequestException as err:
        print(f"OOps: Something Else {err}")

# Call the function with your API Key and target URL
scrape_with_scraperapi(API_KEY, TARGET_URL)

Node.js example

This Node.js example uses the built-in https module or a library like axios to perform the same authenticated request.

const axios = require('axios'); // or use built-in 'https' module

const API_KEY = 'YOUR_API_KEY'; // Replace with your actual API key
const TARGET_URL = 'https://example.com'; // The URL you want to scrape

async function scrapeWithScraperApi(apiKey, targetUrl) {
  try {
    const response = await axios.get('http://api.scraperapi.com/', {
      params: {
        api_key: apiKey,
        url: targetUrl
      }
    });
    console.log(`Status Code: ${response.status.code}`);
    console.log(response.data.substring(0, 500)); // Print first 500 characters
  } catch (error) {
    if (error.response) {
      // The request was made and the server responded with a status code
      // that falls out of the range of 2xx
      console.error(`Error Status: ${error.response.status}`);
      console.error(`Error Data: ${JSON.stringify(error.response.data)}`);
    } else if (error.request) {
      // The request was made but no response was received
      console.error('No response received:', error.request);
    } else {
      // Something happened in setting up the request that triggered an Error
      console.error('Error:', error.message);
    }
  }
}

// Call the function
scrapeWithScraperApi(API_KEY, TARGET_URL);

These examples illustrate the minimal code required to send an authenticated request. ScraperApi also supports additional parameters for advanced control over scraping, such as proxy type, country, and JavaScript rendering, all of which would be appended to the payload or params object alongside your api_key and url.

Security best practices

Protecting your API key is crucial to prevent unauthorized access to your ScraperApi account and usage of your subscription credits. Adhering to security best practices helps mitigate common risks associated with API key management:

1. Do not hardcode API Keys: Avoid embedding your API key directly into your source code. Hardcoding makes it difficult to rotate keys and exposes them if your code repository becomes compromised.
2. Use environment variables: Store your API key as an environment variable on your server or local machine. This keeps the key separate from your codebase and allows for easier management and rotation. Most operating systems and deployment platforms support environment variables. For instance, in Linux/macOS, you can set it with export SCKAPERAPI_API_KEY='YOUR_KEY' and access it in Python via os.environ.get('SCKAPERAPI_API_KEY').
3. Implement secret management solutions: For production environments, consider using dedicated secret management services such as AWS Secrets Manager, Google Cloud Secret Manager, or HashiCorp Vault. These tools provide secure storage, retrieval, and rotation of sensitive credentials. AWS Secrets Manager documentation describes its capabilities for secure credential storage.
4. Restrict access to source code: Ensure that only authorized personnel have access to your codebase and deployment environments where API keys might be configured.
5. Secure local development: When developing locally, use .env files (and ensure they are added to .gitignore) or environment variables to store your API key. Do not commit these files to version control.
6. HTTPS for all communications: Always use HTTPS when communicating with ScraperApi. Your API key is transmitted as a query parameter, and HTTPS encrypts this data in transit, preventing eavesdropping and man-in-the-middle attacks. This is a fundamental principle for securing web traffic, widely supported by web standards such as those from the W3C Security FAQ.
7. Monitor API usage: Regularly review your ScraperApi usage statistics in your dashboard. Unexpected spikes in usage could indicate unauthorized access to your API key.
8. Key rotation: Periodically change your API key. If your key is compromised, rotating it minimizes the window of exposure. ScraperApi's dashboard should provide functionality to regenerate your key.
9. Least privilege principle: While ScraperApi's API key grants broad access to your account's scraping capabilities, apply the principle of least privilege where possible in your overall application architecture. For instance, if you have multiple services or applications interacting with ScraperApi, consider if separate accounts or keys might offer better isolation (if ScraperApi supports multiple keys per account).

By diligently applying these practices, you can significantly enhance the security posture of your applications using ScraperApi.