Authentication
Every product endpoint accepts a bearer credential:
Authorization: Bearer bk_live_...API keys are project-scoped and reveal their full secret only at creation. Revoke a key from the account page when it is no longer needed.
Scopes
| Scope | Access |
|---|---|
v1.scrape | POST /v1/scrape |
v1.browse | POST /v1/browse |
v1.sessions | Create, inspect and revoke browser sessions |
v1.crawl | Run bounded crawls and search retained crawl content |
v1.usage | Read billing quotas and cost telemetry |
* | All current product endpoints; reserve for controlled operator keys |
Existing keys do not gain new scopes automatically. Create a new key when an agent needs browser actions, sessions, crawl/search, or usage access.
Key handling
- Keep keys in a secret manager or environment variable.
- Never send a CrawlVolt key to the target website or page JavaScript.
- Use a separate key per environment and revoke exposed credentials immediately.
- CrawlVolt session ids are safe to log, but the API key remains secret.
- Session cookies are encrypted at rest and are never returned by the public API.
- CrawlVolt does not store raw usernames or passwords.