REST API

Authentication

Authenticate REST requests with an API key.

The REST API accepts Upscrape API keys as bearer tokens. API keys belong to an account and inherit that account's platform visibility, credit balance, rate limits, and credential access.

## Send the key

Include the key on every API request:

```http
Authorization: Bearer UPSCRAPE_API_KEY
```

```bash
curl --header "Authorization: Bearer $UPSCRAPE_API_KEY" \
  'https://data.upscrape.com/api/platforms'
```

Missing, malformed, revoked, or unknown keys return an authentication error. Do not retry authentication failures without changing the credential.

## Store keys safely

- Keep keys in a server-side secret manager or protected environment variable.
- Never embed a key in frontend JavaScript or a mobile binary.
- Never commit a `.env` file containing a key.
- Do not paste keys into tickets, chat, documentation, or agent prompts.
- Create separate keys for separate deployment environments and revoke keys that are no longer needed.

## API keys and MCP OAuth

REST uses API keys. MCP accepts either an API key or an OAuth access token. Prefer OAuth for consumer connectors because the user authorizes the client without copying a long-lived API key into it.

The current MCP scope is `mcp`, which grants the connector the account access needed to use published capabilities at their published credit rates. Finer-grained OAuth scopes are [planned, not currently available](/docs/mcp/scoped-access).

## Authentication is not platform credentials

The Upscrape API key authenticates your Upscrape account. Some scraper capabilities also require credentials for the upstream platform. Those are stored separately through the [credentials API](/docs/api/credentials) and are never substituted for the bearer token.

The REST API accepts Upscrape API keys as bearer tokens. API keys belong to an account and inherit that account's platform visibility, credit balance, rate limits, and credential access.

Send the key

Include the key on every API request:

Authorization: Bearer UPSCRAPE_API_KEY

curl --header "Authorization: Bearer $UPSCRAPE_API_KEY" \
  'https://data.upscrape.com/api/platforms'

Missing, malformed, revoked, or unknown keys return an authentication error. Do not retry authentication failures without changing the credential.

Store keys safely

Keep keys in a server-side secret manager or protected environment variable.
Never embed a key in frontend JavaScript or a mobile binary.
Never commit a .env file containing a key.
Do not paste keys into tickets, chat, documentation, or agent prompts.
Create separate keys for separate deployment environments and revoke keys that are no longer needed.

API keys and MCP OAuth

REST uses API keys. MCP accepts either an API key or an OAuth access token. Prefer OAuth for consumer connectors because the user authorizes the client without copying a long-lived API key into it.

The current MCP scope is mcp, which grants the connector the account access needed to use published capabilities at their published credit rates. Finer-grained OAuth scopes are planned, not currently available.

Authentication is not platform credentials

The Upscrape API key authenticates your Upscrape account. Some scraper capabilities also require credentials for the upstream platform. Those are stored separately through the credentials API and are never substituted for the bearer token.