API Keys

API keys authenticate any non-session client (SDKs, REST calls, automation scripts). The dashboard gives you full lifecycle management—create, rotate, disable, and audit usage—without touching the database.

Where API keys are used

Dashboard playground: runs on server-side sessions but can reuse API keys for persistent server integrations.
SDK & REST clients: include the key in either the Authorization: Bearer <key> header or the x-api-key header. One header is enough.
Automation platforms: copy the key into CI/CD secrets, Zapier, Airtable scripts, etc., to trigger crawls without user logins.

Generate a new key

Open the dashboard at API Keys and click New API Key.

Choose an expiration (never, 30/60/90 days, 6 months, 1 year) and name the key so teammates recognize its purpose.

After creation, copy the full token. For user-managed keys, this is the only time the dashboard can display the entire key (we never store the plaintext key server-side).

Lost keys cannot be recovered—create a new one and update consumers.

Self-hosting with separate dashboard/API apex domains? The dashboard may create a system-managed key named PLAYGROUND_API_KEY and store its plaintext value on the device (localStorage) so it can call your API when cookie sessions aren't available. You can rotate it from the API Keys page.

CLI and local development

export DEEPCRAWL_API_KEY="dc_sk_live_your_key"

# .env.local (server only)
DEEPCRAWL_API_KEY=dc_sk_live_your_key

Add the key as a secret (e.g., DEEPCRAWL_API_KEY) inside GitHub Actions, Vercel, or Cloudflare Workers. Inject it at runtime and never commit it to git.

Manage existing keys

Use the row menu to edit the display name after creation. Helpful for tracking ownership or scope.
Add descriptions in your team docs referencing the dashboard name so rotations are painless.

Toggle a key to “Disabled” to pause access without losing the secret.
Ideal when investigating suspicious activity or preparing a planned maintenance window.

Delete keys you no longer need; the dashboard warns that the action is irreversible.
When rotating, create a replacement key first, update all consumers, confirm traffic shifts, then delete the old one.

Using API keys in code

import { DeepcrawlApp } from 'deepcrawl';

const deepcrawl = new DeepcrawlApp({
  apiKey: process.env.DEEPCRAWL_API_KEY as string,
});

export async function run() {
  const markdown = await deepcrawl.getMarkdown('https://example.com');
  return markdown;
}

curl \
  -H "Authorization: Bearer $DEEPCRAWL_API_KEY" \
  "https://api.deepcrawl.dev/read?url=https://example.com"