Every request carries your scraping key. Keys look like df_key_… (32 characters after the prefix).

curl https://scraping-api.datafuel.ai/api/v1/users/@me/balance \
  --header 'X-API-Key: df_key_your_key_here'

Authorization: Bearer df_key_… is accepted too; X-API-Key wins when both are sent. A missing or unknown key answers 401, a deactivated account 403.

Keep the key server-side. Never call the API from a browser or an app you ship to users.

Credits and limits

Credits are charged per task when it is queued and refunded if it fails. Check what is left, split into plan and pay-as-you-go credits, with GET /users/@me/balance; your concurrency and monthly limits are on GET /users/@me.

Managing the key

Rotate the key with POST /users/@me/api-key/reset, authenticated with the key you are replacing. The old key stops working at once and the new one is returned only in that response, so store it before you close the connection. If the reset answers 503 API_KEY_RESET_FAILED, nothing changed and the old key still works.

Your scraping key belongs to your scraping plan. The plan itself is managed through the User API, under Web scraping, with a dashboard key (df_live_…).