Authentication

Overview

Every Crawlbase account has two tokens, generated automatically when you sign up. Both authenticate the same account and share the same quota — they just route requests through different infrastructure.

How to authenticate

Pass your token as the token query parameter on every request. That's the entire authentication scheme.

curl 'https://api.crawlbase.com/?token=YOUR_TOKEN&url=https%3A%2F%2Fexample.com'

from crawlbase import CrawlingAPI

# Pass your token at construction; reuse the client across requests
api = CrawlingAPI({'token': 'YOUR_TOKEN'})
res = api.get('https://example.com')

const { CrawlingAPI } = require('crawlbase');

const api = new CrawlingAPI({ token: process.env.CRAWLBASE_TOKEN });
const res = await api.get('https://example.com');

require 'crawlbase'

api = Crawlbase::API.new(token: ENV['CRAWLBASE_TOKEN'])
res = api.get('https://example.com')

 getenv('CRAWLBASE_TOKEN')]);
$res = $api->get('https://example.com');

package main

import (
    "os"
    "github.com/crawlbase/crawlbase-go"
)

func main() {
    api := crawlbase.NewCrawlingAPI(os.Getenv("CRAWLBASE_TOKEN"))
    res, _ := api.Get("https://example.com")
    _ = res
}

Picking the right token

Quick decision tree:

If you're not sure, try Normal first. If the response is missing content you can see in your browser, switch to JavaScript.

Security & rotation

Treat tokens like passwords. Don't commit them to version control, don't paste them in support tickets, and rotate them if you suspect a leak.

• Use environment variables — never hard-code tokens in source files.
• Rotate from the dashboard — the "Reset token" button generates a new value and immediately invalidates the old one.
• One token per environment — keep development and production on separate accounts so a leak in one doesn't poison the other.
• Never expose tokens client-side — Crawlbase calls must originate from your backend. A token in browser JavaScript is a token in everyone's hands.

Auth-related errors

If something's wrong with your token, you'll get one of these responses:

For the full set of status codes, see Status Codes.

Next steps