Docs examples target https://api.scrapy.infralyon.com (not production https://api.scrapy.io).
Skip to main content

Authentication

Every Platform API request (api.scrapy.infralyon.com/v1/...) must be authenticated with a Scrapy.io API key. The same key is used for publisher execution hosts ({publisher}.p.scrapy.infralyon.com).

Create a key​

  1. Sign in to the Scrapy.io console.
  2. Open API keys (account / integrations).
  3. Create or regenerate a key.
  4. Copy it once — treat it like a password.

Keys typically look like:

scrapy_api_AbCdEfGhIjKlMnOp
Authorization: Bearer scrapy_api_...
curl "https://api.scrapy.infralyon.com/v1/tools?limit=1" \
  -H "Authorization: Bearer $SCRAPY_API_KEY"

Alternate header​

X-API-Key: scrapy_api_...
curl "https://api.scrapy.infralyon.com/v1/tools?limit=1" \
  -H "X-API-Key: $SCRAPY_API_KEY"

Both are supported. Prefer Bearer in docs, SDKs, and production clients.

What not to do​

  • Do not pass the key as a query parameter (?token= / ?apiKey=).
  • Do not embed keys in public repos, screenshots, or client-side frontend code that ships to browsers.
  • Do not send a userId (or similar) to “select” whose data to read — ownership comes only from the key.

How ownership works​

API key
  → validateApiKey
  → authenticated user / account
  → all private resources filtered by that user

For private resources (runs, schedules, datasets):

Client sendsServer uses
runIdrunId and authenticated user id
scheduleIdscheduleId and authenticated user id

If the resource exists but belongs to another account, the API responds with 404 Not found (not 403), so resource ids are not enumerable across tenants.

Missing or invalid key​

{
  "error": {
    "type": "unauthorized",
    "message": "Authentication token was not provided",
    "doc_url": "https://docs.scrapy.io/errors/unauthorized"
  }
}

HTTP status: 401.

CORS​

Browser apps calling api.scrapy.infralyon.com must use allowed origins configured for your deployment. Server-to-server calls (backend, workers, CI) do not need CORS.