Authentication
Every request needs an API key. Create and revoke keys in Dashboard → API keys.
Sending the key
Use the X-API-Key header (recommended):
curl "https://api.serpwiz.com/v1/google/search?q=hello" -H "X-API-Key: sw_live_…"
These also work, in order of precedence after X-API-Key:
| Method | Example | Notes |
|---|---|---|
| Bearer token | Authorization: Bearer sw_live_… |
Handy for HTTP clients and agent frameworks that only support bearer auth. |
| Query parameter | ?api_key=sw_live_… |
Convenient for quick tests and spreadsheets. Avoid it in production: URLs end up in logs and browser history. |
Keys and limits
- Keys are shown once, when you create them. We store only a hash. If you lose a key, revoke it and create a new one.
- You can have up to 20 active keys — one per app or environment makes revoking painless.
- All keys on an account share one rate limit and one balance. More keys don't add throughput; a bigger plan does. See Rate limits.
- You must verify your email address before keys work.
Keep keys secret
API keys can spend your balance. Don't ship them in front-end JavaScript or mobile apps — call SerpWiz from your server, and pass results to the client. If a key leaks, revoke it in the dashboard; it stops working within a few minutes everywhere.
Errors
| Status | code |
Meaning |
|---|---|---|
401 |
unauthorized |
The key is missing, malformed, invalid or revoked. |
403 |
email_unverified |
Verify your email address first. |
403 |
account_suspended |
Contact [email protected]. |
This page as Markdown: /docs/authentication.md