Authorization: Bearer YOUR_API_KEY or API-KEY: YOUR_API_KEY. Supply exactly one credential header. Search needs the scrapes:write scope. Keep credentials in a server-side secret environment; never put them in browser code, URLs, or source control.
Test keys return deterministic fixtures with simulated: true and zero request units. Live keys use your API workspace allowance. Keys may also have expiry and IP restrictions.