Get Authenticated with the API

To start using the Scrupp API, sign up for a free account at app.scrupp.com and navigate to Settings → API Keys to generate your key. Every request must carry that key in one of three ways — Authorization: Bearer, the X-API-Key header, or the api_key query parameter — and all three work on every endpoint, including status and result polling. Keep this key private — do not commit it to version control or expose it in client-side code. If your key is compromised, regenerate it immediately from the settings page. Free-tier accounts receive a limited number of credits each month, which is enough to test every endpoint before upgrading.

Store your API key in environment variables or a secrets manager — never hard-code it into your application source. Rotate your key periodically by generating a new one in your account settings and updating all integrations. If you suspect your key has been leaked, regenerate it immediately to prevent unauthorized usage. Each API key is tied to your account's credit balance, so unauthorized access could consume your credits. For server-to-server integrations, restrict outbound requests to your API server's IP range when possible. Free-tier keys and paid-tier keys use the same authentication mechanism; the only difference is the credit allowance.

Requests are limited to 2,000 per minute per API key. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, so you can pace a bulk run without guessing. Exceeding the limit returns 429 with a Retry-After header and a retry_after field in the body — wait that many seconds and continue. The limit counts HTTP requests, not credits or records: one job that scrapes 10,000 rows is a single request.