Manage API credentials safely
Overview
Create API keys in the dashboard with the scrapes:write scope for search. Use a separate key per integration, and a test key for simulated fixtures. Inject secrets into server-side environment variables or your MCP client’s secret store.
Usage
Use Authorization: Bearer or API-KEY, never a URL parameter. Keep keys out of browser bundles, source control, screenshots, and logs. Rotate exposed keys and revoke unused integrations. Each key remains subject to its workspace’s plan, rate limits, and IP restrictions.
See the Search API documentation for the current contract.