Authentication

Every Platform API request (api.scrapy.infralyon.com/v1/...) must be authenticated with a Scrapy.io API key. The same key is used for publisher execution hosts ({publisher}.p.scrapy.infralyon.com).

Create a key

1. Sign in to the Scrapy.io console.
2. Open API keys (account / integrations).
3. Create or regenerate a key.
4. Copy it once — treat it like a password.

Keys typically look like:

sc_AbCdEfGhIjKlMnOpQrStUvWxYz0123456789a

Canonical header (recommended)

x-api-key: sc_...

curl "https://api.scrapy.infralyon.com/v1/tools?limit=1" \
  -H "x-api-key: $SCRAPYIO_API_KEY"

Header names are case-insensitive (X-API-Key, X-API-KEY, etc. all work). Examples and SDKs use lowercase x-api-key.

Alternate header

Authorization: Bearer sc_...

curl "https://api.scrapy.infralyon.com/v1/tools?limit=1" \
  -H "Authorization: Bearer $SCRAPYIO_API_KEY"

Both are supported. Prefer x-api-key in docs, SDKs, MCP, and production clients.

Environment variable names

The API key value is the same everywhere.

Context	Variable	Notes
JavaScript SDK, Python SDK, MCP	x-api-key	Canonical; any casing accepted by MCP / helpers
Raw HTTP / curl examples on this site	SCRAPYIO_API_KEY	Shell-friendly name for the same key value
Legacy	SCRAPYIO_API_KEY	Still accepted by MCP and some scripts if x-api-key is unset

export SCRAPYIO_API_KEY="sc_..."
# MCP / Node often use a hyphenated env key:
# export x-api-key="$SCRAPYIO_API_KEY"

See JavaScript SDK, Python SDK, and MCP.

What not to do

• Do not pass the key as a query parameter (?token= / ?apiKey=).
• Do not embed keys in public repos, screenshots, or client-side frontend code that ships to browsers.
• Do not send a userId (or similar) to “select” whose data to read — ownership comes only from the key.

How ownership works

API key
  → validateApiKey
  → authenticated user / account
  → all private resources filtered by that user

For private resources (runs, schedules, datasets):

Client sends	Server uses
runId	runId and authenticated user id
scheduleId	scheduleId and authenticated user id

If the resource exists but belongs to another account, the API responds with 404 Not found (not 403), so resource ids are not enumerable across tenants.

Missing or invalid key

{
  "error": {
    "type": "unauthorized",
    "message": "Authentication token was not provided",
    "doc_url": "https://docs.scrapy.io/errors/unauthorized"
  }
}

HTTP status: 401.

CORS

Browser apps calling api.scrapy.infralyon.com must use allowed origins configured for your deployment. Server-to-server calls (backend, workers, CI) do not need CORS.

Next: Find a scraper. Key errors are listed under Errors.