Auth

CrawlPipe has two separate auth planes. This page covers the one you'll use as an API consumer.

API keys (`/v1/*`)

Every request to the public API authenticates with a bearer API key:

Authorization: Bearer dp_live_a1b2c3d4e5f6…

Keys are org-scoped — every key belongs to an organization, never a single user. Format is dp_live_ followed by 32 random base62 characters.

One-time display

The full key is only ever shown once, at creation time, in the portal. After that, CrawlPipe stores only a sha256 hash and can display just the first few characters (the prefix) for identification. If you lose a key, revoke it and create a new one — there's no way to recover the original value.

Email verification is required before you can create any key (this keeps the free tier from being abused by disposable accounts).

Scopes

Scope	Grants
`read`	All `GET /v1/{domain}/*` data endpoints (search, documents, changes, …)
`manage`	Webhook management and usage endpoints via the API

New keys default to {read}. Request manage explicitly when creating a key if your integration needs to create/list/delete webhooks through the API instead of the portal UI.

Revocation

Revoking a key in the portal takes effect immediately in the database; an in-process cache on the API means propagation is bounded at 60 seconds. After that, requests with a revoked key get 401 invalid_key.

Portal sessions (`/portal/*`)

The portal itself (this site) authenticates with an httpOnly session cookie plus a CSRF double-submit token — this is not part of the public API and isn't something you use from your own integration.

Rate limits & plans

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset (unix timestamp) headers, independent of the units model covered in Metering & idempotency. Limits are per plan — see Pricing.