Authentication

OmniScrape has two auth surfaces:

• Dashboard — sign in with Google or GitHub OAuth at omniscrape.io/login. The browser session uses an HTTP-only cookie; use dashboard endpoints like POST /auth/rotate-api-key with that session.
• API — pass your API key in the X-API-Key header on every /v1/* request. The same key authorizes Web Unlocker, Browser-as-a-Service, and residential proxy usage.

curl https://api.omniscrape.io/v1/scrape \
  -H "X-API-Key: osk_live_..."

Where to find your key

Open the dashboard, go to API Keys, and copy the value. Each account starts with one live key (osk_live_… prefix).

Rotating your key

If a key leaks, rotate it from Dashboard → API Keys → Rotate. Rotation issues a new key immediately and invalidates the old one, so update your environment variables before rotating in production.

Keeping keys safe

• Store keys in environment variables or a secret manager, never in Git.
• Use separate keys for staging and production where possible.
• Do not embed keys in client-side code, mobile apps, or browser extensions — anyone who views the bundle can read them. Always call OmniScrape from your backend.

Proxy credentials

When you use residential proxies directly (not through the scrape API), you get a dedicated proxy username and password in Dashboard → Proxies. They are separate from your API key.

Free-trial accounts cannot view or use direct proxy credentials. Proxy is still used automatically when you call Web Unlocker or BaaS. To unlock direct access, activate PAYG (minimum $5 top-up) or subscribe to a paid plan.

Gateway host: proxy.omniscrape.io

Protocol	Port
HTTP	8080
HTTPS	8443
SOCKS5	1080

Country targeting: append _country-<CC> to the proxy username (e.g. os_user_country-DE). See Proxies.

Rotating proxy credentials

Unlocked accounts can rotate the proxy password from the dashboard or with a session-authenticated request:

POST /auth/rotate-proxy-credentials

The username is unchanged; only the password is regenerated. Trial accounts receive 402 with code PROXY_LOCKED.

Errors

A missing or invalid key returns 401:

{ "success": false, "error": "Invalid or missing API key" }

See Errors for the full list of status codes.