API Key Management and Security
ProxyTurk API uses Bearer token-based authentication. This guide covers API key creation, security practices, and error handling.
# Request with API keycurl -X POST https://api.proxyturk.com/v1/scrape \ -H "Authorization: Bearer sk_live_your_api_key" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com"}'# Using environment variableexport PROXYTURK_API_KEY="sk_live_your_api_key"curl -X POST https://api.proxyturk.com/v1/scrape \ -H "Authorization: Bearer $PROXYTURK_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com"}'Log into the dashboard and navigate to "API Keys" from the sidebar. Click "Create New Key" to generate a new API key.
You can set a name for each key (e.g., "Production", "Development", "Test"). This naming helps you track which key is used where.
Send your API key as a Bearer token in the Authorization header with every request:
Authorization: Bearer sk_live_your_api_key_here
Keys start with "sk_live_" or "sk_test_" prefix. Test keys do not perform real operations and do not consume credits.
When creating API keys, you can define the permission scope:
- scrape: Access to web scraping endpoints - parse: Access to AI Parser endpoints - serp: Access to SERP API endpoints - jobs: Job status querying - keys: API key management (create/delete)
All permissions are active by default. For security, only grant the permissions you need.
Rate limits are determined by your plan:
- Free: 10 requests/minute - Pro: 100 requests/minute - Business: 500 requests/minute - Enterprise: Custom limit
Every response includes rate limit info in headers: - X-RateLimit-Limit: Total limit per minute - X-RateLimit-Remaining: Remaining request quota - X-RateLimit-Reset: Unix timestamp when limit resets
1. Store your API key as an environment variable, not in code 2. Never commit to git (add .env to .gitignore) 3. Do not use API keys in frontend code (use only in backend) 4. Create different keys for different environments (dev/staging/prod) 5. Immediately revoke unused keys 6. Rotate your keys regularly (recommended every 3 months)
401 Unauthorized: - API key is missing or invalid - Key has been revoked - Authorization header format is wrong
403 Forbidden: - Key does not have permission for this endpoint - IP whitelist restriction - Account suspended
Solution: Check key status in dashboard, create a new key, or contact support.
Questions about authentication
Revoke the existing key from the dashboard and create a new one. The old key becomes invalid immediately.
Yes, we recommend creating separate keys for each project or environment. This way, if a key is compromised, you only need to revoke that one.
Keys with sk_test_ prefix are for testing. They do not perform real scraping, return mock data, and do not consume credits. Ideal for testing your integration.