scrapestack Authentication: API Key Setup & Security (2026)

Authentication overview

scrapestack provides a streamlined authentication process centered around a unique API key. This key serves as the primary credential for all interactions with the scrapestack API, granting access to its features such as rotating proxies, CAPTCHA bypassing, and JavaScript rendering capabilities scrapestack documentation. The API key is a mandatory component of every request and is typically transmitted as a query parameter in the request URL.

The design prioritizes ease of use and rapid integration, making it suitable for developers requiring quick setup for web scraping tasks. Unlike more complex authentication flows like OAuth 2.0, scrapestack's API key approach minimizes configuration overhead. However, this simplicity places a greater emphasis on the secure management and protection of the API key itself, as its compromise could lead to unauthorized usage of your scrapestack account.

Supported authentication methods

scrapestack exclusively supports API key authentication. This method involves including a unique, secret API key with each request to verify the sender's identity and authorize access to the service. The API key acts as a digital signature, ensuring that only authenticated users can utilize the scrapestack infrastructure.

The table below outlines the specifics of scrapestack's supported authentication method:

This single-method approach simplifies the developer experience by removing the need to manage multiple authentication schemes or complex token negotiation processes. For developers familiar with RESTful API patterns, integrating the API key into request URLs is a common and straightforward practice. It's important to note that while easy to implement, API keys, when exposed, can pose a security risk, as discussed in the security best practices section.

Getting your credentials

To begin using the scrapestack API, you must first obtain your unique API key. This key is automatically generated upon account creation and is accessible through your scrapestack dashboard. Follow these steps to retrieve your API key:

1. Sign Up/Log In: Navigate to the scrapestack homepage and either sign up for a new account or log in to an existing one. A free tier offering 10,000 requests per month is available for new users.
2. Access Dashboard: Once logged in, you will be directed to your personal scrapestack dashboard.
3. Locate API Key: Your API key (often labeled as Your API Access Key or similar) will be prominently displayed on the dashboard, typically near the top of the page or within an 'API Settings' section.
4. Copy Key: Copy the displayed API key. This is the value you will include in your API requests.

The API key is a long, alphanumeric string that uniquely identifies your account. It is crucial to treat this key as sensitive information, similar to a password, to prevent unauthorized use of your scrapestack resources. If you suspect your API key has been compromised, you should regenerate it immediately through your scrapestack dashboard, if the option is provided, or contact scrapestack support for assistance.

Authenticated request example

Once you have obtained your API key, you can integrate it into your scrapestack API calls. The API key is passed as a query parameter named access_key. Below are examples demonstrating how to make an authenticated request using common programming languages and cURL.

cURL Example

This cURL command demonstrates a basic request to scrape a URL, including the access_key parameter:

curl 'http://api.scrapestack.com/scrape
  ?access_key=YOUR_API_ACCESS_KEY
  &url=http://example.com'

Python Example

Using the requests library in Python, an authenticated request looks like this:

import requests

API_KEY = 'YOUR_API_ACCESS_KEY'
TARGET_URL = 'http://example.com'

params = {
    'access_key': API_KEY,
    'url': TARGET_URL
}

response = requests.get('http://api.scrapestack.com/scrape', params=params)

if response.status_code == 200:
    print(response.text)
else:
    print(f"Error: {response.status_code} - {response.text}")

Node.js Example

An example using Node.js with the axios library:

const axios = require('axios');

const API_KEY = 'YOUR_API_ACCESS_KEY';
const TARGET_URL = 'http://example.com';

axios.get('http://api.scrapestack.com/scrape', {
  params: {
    access_key: API_KEY,
    url: TARGET_URL
  }
})
.then(response => {
  console.log(response.data);
})
.catch(error => {
  console.error(`Error: ${error.response.status} - ${error.response.data}`);
});

In all examples, replace YOUR_API_ACCESS_KEY with your actual API key retrieved from the scrapestack dashboard. Additional parameters for features like JavaScript rendering (render_js=1) or proxy settings can be appended to the URL as needed, as described in the scrapestack API documentation.

Security best practices

Given that scrapestack relies solely on API key authentication, implementing robust security practices for managing your API key is paramount. Neglecting these practices can lead to unauthorized access to your account and potentially expose sensitive data or incur unexpected charges.

• Environment Variables: Avoid hardcoding your API key directly into your application's source code. Instead, store it as an environment variable. This practice keeps the key out of version control systems and allows for easier rotation and management across different deployment environments. For example, in a Linux/macOS environment, you might set export SCRAPESTACK_API_KEY="your_key_here". Google Cloud documentation on API key security recommends using environment variables for sensitive credentials.
• Secret Management Services: For production environments, consider using dedicated secret management services like AWS Secrets Manager, Google Secret Manager, or HashiCorp Vault. These services provide secure storage, versioning, and access control for API keys and other sensitive credentials, integrating with your application's deployment pipeline. AWS Secrets Manager documentation details its capabilities for secure credential storage.
• Restrict Access: Limit who has access to your API key. Only individuals or systems that absolutely require it for operation should be granted access. Implement role-based access control (RBAC) where possible to enforce the principle of least privilege.
• Secure Communication (HTTPS): Always use HTTPS for all API requests to scrapestack. This encrypts the communication channel, protecting your API key and other request data from interception during transit. scrapestack's API endpoints are designed to be accessed via HTTPS by default.
• IP Whitelisting (if available): Check if scrapestack offers IP whitelisting capabilities. If so, configure your account to only accept API requests originating from a predefined list of trusted IP addresses. This adds an extra layer of security by blocking requests from unknown locations.
• Monitoring and Alerting: Implement monitoring for your scrapestack account usage. Set up alerts for unusual activity, such as a sudden spike in requests or usage from unexpected geographical locations. This can help detect and respond to potential compromises quickly.
• Key Rotation: Periodically rotate your API key. While scrapestack's dashboard does not explicitly offer an API key rotation feature, if you suspect a compromise or as part of a regular security policy, you should create a new account to obtain a new API key and update your applications accordingly. This limits the window of exposure for a compromised key.
• Client-Side Exposure: Never embed your API key directly into client-side code (e.g., JavaScript running in a web browser or mobile app). Client-side code is easily inspectable, and exposing your API key there would make it publicly available to anyone. All scrapestack API calls should originate from a secure backend server.