> ## Documentation Index
> Fetch the complete documentation index at: https://webscrape.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API key format, generation, rotation, and common auth errors.

Every API call needs an API key in the `X-API-Key` header.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.webscrape.ai/v1/scrape \
    -H "X-API-Key: wsg_live_..." \
    -H "Content-Type: application/json" \
    -d '{"website_url": "https://example.com"}'
  ```

  ```python Python theme={null}
  import requests

  requests.post(
      "https://api.webscrape.ai/v1/scrape",
      headers={"X-API-Key": "wsg_live_..."},
      json={"website_url": "https://example.com"},
  )
  ```

  ```js Node theme={null}
  await fetch("https://api.webscrape.ai/v1/scrape", {
    method: "POST",
    headers: { "X-API-Key": "wsg_live_...", "Content-Type": "application/json" },
    body: JSON.stringify({ website_url: "https://example.com" }),
  });
  ```

  ```go Go theme={null}
  req, _ := http.NewRequest("POST", "https://api.webscrape.ai/v1/scrape",
      bytes.NewBufferString(`{"website_url":"https://example.com"}`))
  req.Header.Set("X-API-Key", "wsg_live_...")
  req.Header.Set("Content-Type", "application/json")
  http.DefaultClient.Do(req)
  ```

  ```rust Rust theme={null}
  reqwest::Client::new()
      .post("https://api.webscrape.ai/v1/scrape")
      .header("X-API-Key", "wsg_live_...")
      .json(&serde_json::json!({ "website_url": "https://example.com" }))
      .send()
      .await?;
  ```
</CodeGroup>

## Key format

Keys look like `wsg_live_<32 base62 chars>`. The `wsg_live_` prefix marks them as production keys. The full secret is shown **once** at generation time — after that, we don't have it either.

Lost a key? Generate a new one and revoke the old. There's no recovery flow.

## Generating a key

<Steps>
  <Step title="Open the dashboard">
    Go to [API Keys](https://webscrape.ai/app/api-keys).
  </Step>

  <Step title="Click Generate">
    Label the key so you can tell which integration it belongs to later.
  </Step>

  <Step title="Copy the secret immediately">
    The cleartext appears once. Put it in a secrets manager — never in source control.
  </Step>
</Steps>

## Revoking a key

Click **Revoke** on the row in the dashboard. It takes effect immediately — the next request with that key gets a `401 Unauthorized`.

## Rotation

There's no automated rotation yet. To rotate by hand:

1. Generate a new key.
2. Deploy it to your application.
3. Confirm requests succeed under the new key (the [Usage](https://webscrape.ai/app/usage) page is the easy check).
4. Revoke the old key.

## Errors

| Status                 | Meaning                                          |
| ---------------------- | ------------------------------------------------ |
| `401 Unauthorized`     | Missing or revoked key                           |
| `402 Payment Required` | Out of credits. See [Credits](/docs/concepts/credits) |

See [Errors](/docs/concepts/errors) for the full response shape.