Authentication

Create an API key from Dashboard → API keys. The complete secret is shown once. Store it in a secret manager or a local environment variable, never in browser code or source control.

export BERRYCRAWL_API_KEY="bc_..."

Every public API request uses the standard bearer header:

curl https://api.berrycrawl.com/api/v1/scrape \
  -H "Authorization: Bearer $BERRYCRAWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://berrycrawl.com","formats":["markdown"]}'

Key handling

• Give production and development separate keys.
• Use descriptive names so a leaked or unused key is easy to revoke.
• Rotate a key by creating its replacement first, deploying it, then deleting the old key.
• Never put a bc_ key in VITE_*, NEXT_PUBLIC_*, client-side JavaScript, logs, or screenshots.

A missing, malformed, revoked, or unknown key returns 401 Unauthorized. A valid key without enough credits returns a client error before paid work begins.

Agent claim flow

An autonomous agent can register and hand account ownership to a human through Berrycrawl's claim flow. The agent receives a short-lived claim URL; the human signs in, accepts the workspace, and becomes its owner. See Agent setup for the complete sequence.