Authentication
How to authenticate with the SocialCrawl API using the x-api-key header
Authentication
Every request to the SocialCrawl API requires an API key passed via the x-api-key header. There is no OAuth flow, no token exchange, and no session — the key is the entire credential.
Getting Your API Key
- Sign up at socialcrawl.dev — you get 100 welcome credits instantly
- Navigate to Dashboard → API Keys
- Click Create Key and give it a descriptive name (e.g.
production,staging,local-dev) - Copy the key from the one-time reveal dialog — this is the only time the full key is shown
Keys have the format sc_ followed by 32 random bytes (base64url-encoded), so every key is 46 characters long. Only the last 4 characters are displayed in the dashboard after creation.
Using Your Key
Include the x-api-key header with every request:
curl https://socialcrawl.dev/v1/tiktok/profile?handle=charlidamelio \
-H "x-api-key: sc_your_api_key_here"const response = await fetch(
"https://socialcrawl.dev/v1/tiktok/profile?handle=charlidamelio",
{ headers: { "x-api-key": "sc_your_api_key_here" } },
);import requests
response = requests.get(
"https://socialcrawl.dev/v1/tiktok/profile",
params={"handle": "charlidamelio"},
headers={"x-api-key": "sc_your_api_key_here"},
)Missing or malformed keys return 401 MISSING_API_KEY / 401 INVALID_API_KEY. See Error Handling for the full list.
Key Management
| Rule | Value |
|---|---|
| Active keys per account | Up to 5 |
| Storage | SHA-256 hash for auth lookup, AES-256-GCM encrypted for retrieval |
| Revocation | Soft delete — revoked keys return 401 INVALID_API_KEY immediately |
| Expiry | Optional per-key expires_at (unset = never) |
| Rotation | Create a new key, update clients, revoke the old one |
Revoke compromised keys from Dashboard → API Keys as soon as possible — a revoked key is rejected on the very next request.
Security Recommendations
- Never embed keys in client-side code. Every request using your key is billed to your account. Use a server proxy when calling from browsers or mobile apps.
- Use separate keys per environment. Revoking a staging key shouldn't take down production.
- Store keys in a secret manager (Vercel Encrypted Env, AWS Secrets Manager, 1Password, etc.) — not in git.
- Set an
expires_aton any key you issue to a contractor or short-lived job.
Related
- Credits — how billing works
- Response Schema — what comes back
- Error Handling — what to do when things break
