Authentication — ScrapeField

Send the key

As a bearer token, on every request:

curl "https://api.scrapefield.com/v1/instagram/profile?username=nasa" \
  -H "Authorization: Bearer $SCRAPEFIELD_KEY"

Keys

A key looks like sf_live_ followed by 32 random characters. The prefix makes a leaked key easy to spot in a secret scanner.
You create keys in the dashboard. A key is shown once, when it’s created. We keep only its hash, so we can’t show it again or recover it.
An account can have 10 active keys. Give each a name, one per app or environment, so you can tell them apart in the requests log.
Revoking a key takes effect on the next call. A revoked key never works again, and stays listed so you can see what was cut off.

Limit a key to some platforms

When you create a key you can tick the platforms it may call: any of Google Maps, LinkedIn, Instagram, TikTok. A call to anything else is refused with scope_not_allowed, and costs nothing. A key with every platform ticked, or none, may call all of them.

Never in a URL

A key in a query string ends up in server logs, proxies and browser history, so the API refuses ?api_key= with key_in_url. The one exception is the MCP server, because some MCP clients can only be given a URL.

Demo mode: no key at all

Any endpoint answers demo=true without a key. The answer is one fixed sample, the same whatever you ask about, in exactly the real shape, and it’s free. It’s meant for trying the API and for building against it before you have an account. It never returns real data, and a call that sends a key is never a demo.

Errors

Code	HTTP	When, and what to do
`missing_api_key`	401	No Authorization header was sent. Send `Authorization: Bearer sf_live_…`. Create a key in the dashboard.
`invalid_api_key`	401	The key is unknown or was revoked. Check the key, or create a new one. Revoked keys never come back.
`key_in_url`	400	The key was sent as `?api_key=` in the URL. Send it in the `Authorization: Bearer …` header. A key that has been in URLs may be in someone's logs: consider revoking it.
`unverified_account`	403	Calling the API before confirming your email address. Open the link we emailed. Confirming the address adds the trial credits and signs you in.
`scope_not_allowed`	403	The key is scoped to some surfaces and this is not one of them. Use a key with the surface in its scopes, or widen the key.