Machine requests use an organization API key in the Authorization header:
Authorization: Bearer YOUR_API_KEY
Create and revoke keys from Dashboard > API keys. Organization owners and admins manage keys. The secret appears once at creation; the dashboard later shows only a prefix.
Scopes
Keys can carry scrape, map, or both scopes. /v1/scrape and /v1/quote require scrape. /v1/map requires map. A key missing a scope receives 403.
Key safety
Keep keys on your server. Do not put them in client-side JavaScript, public repositories, or URLs. Create separate keys for separate services so each can be revoked without disrupting the others.
The dashboard and playground use signed-in Clerk sessions. A browser session cannot replace an API key on the machine scrape and map endpoints.
See the dashboard API for session-authenticated routes.