Authentication

Create an API key from Dashboard → API keys. The complete secret is shown once. The agent does not need a Berrycrawl login, OAuth flow, or claim code. A human creates the key and adds it to the project environment; the application reads it on the server.

export BERRYCRAWL_API_KEY="bc_..."

For a project, put the same variable in its existing server-side environment file or deployment secret store:

BERRYCRAWL_API_KEY=bc_...

Do not paste the key into a chat, commit it, or expose it through a VITE_*, NEXT_PUBLIC_*, or other browser-visible variable.

Every public API request uses the standard bearer header:

curl https://api.berrycrawl.com/api/v1/scrape \
  -H "Authorization: Bearer $BERRYCRAWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://berrycrawl.com","formats":["markdown"]}'

Key handling

• Give production and development separate keys.
• Use descriptive names so a leaked or unused key is easy to revoke.
• Rotate a key by creating its replacement first, deploying it, then deleting the old key.
• Never put a bc_ key in VITE_*, NEXT_PUBLIC_*, client-side JavaScript, logs, or screenshots.

A missing, malformed, revoked, or unknown key returns 401 Unauthorized. A valid key without enough credits returns a client error before paid work begins. See Agent quickstart for the copy-paste setup prompt.