Authentication

Bearer keys: how to make one, what it reaches, and how to revoke it.

Every request carries an API key in an Authorization header, as a bearer token:

Authorization: Bearer wrp_live_8fKp2mQx9tR4vN7c

There is no other way to authenticate. A key in a query string would end up in server logs, browser history and referrer headers, so the API refuses one.

Creating a key

In the dashboard, open Plan and usage → API keys and choose New key. Give it a name describing what will use it, because a list of keys called "key 1" and "key 2" is a list nobody can safely revoke from.

What a key reaches

A key belongs to one workspace. It sees the tracked pages, crawls and monitors of that workspace and nothing from any other, so a key handed to a client's developer cannot read another client's data.

It spends the account's allowance, though. Workspaces share the monthly pool, which is why a key is worth treating as a credential rather than a convenience.

How many keys

Reaching the limit does not disable anything: you revoke a key you are no longer using and create another.

Revoking a key

Revoking takes effect immediately, on the next request. A revoked key returns 401 with revoked_key and the date it was revoked, so an integration that suddenly stops working reports why rather than looking like an outage.

{
    "error": {
        "code": "revoked_key",
        "message": "That API key was revoked on 24 September 2026."
    }
}