Authentication
Create, scope and rotate CrawlVolt API keys, then authenticate HTTP requests with a bearer token.
Every product endpoint accepts a bearer credential:
Authorization: Bearer bk_live_...API keys are project-scoped and reveal their full secret only at creation. Create or revoke a key from API keys. If you are new to CrawlVolt, create an account and continue to API keys.
Scopes
| Scope | Access |
|---|---|
v1.scrape | POST /v1/scrape |
v1.browse | POST /v1/browse |
v1.sessions | Create, inspect and revoke browser sessions |
v1.crawl | Run bounded website crawls |
v1.search | Search the live web, news, and images |
v1.usage | Read billing quotas and cost telemetry |
* | All current product endpoints; reserve for controlled operator keys |
Existing keys do not gain new scopes automatically. Create a new key when an agent needs browser actions, sessions, crawl, search, or usage access.
Key handling
- Keep keys in a secret manager or environment variable.
- Never send a CrawlVolt key to the target website or page JavaScript.
- Use a separate key per environment and revoke exposed credentials immediately.
- CrawlVolt session ids are safe to log, but the API key remains secret.
- Browser cookies are never returned by the public API.