Skip to main content

Authentication

OmniScrape uses a single API key passed in the X-API-Key request header. The same key authorizes Web Unlocker, Browser-as-a-Service, and residential proxy usage.


curl https://api.omniscrape.io/v1/scrape \
  -H "X-API-Key: osk_live_..."

Where to find your key​

Open the dashboard, go to API Keys, and copy the value. Each account starts with one live key.

Rotating your key​

If a key leaks, rotate it from Dashboard → API Keys → Rotate. Rotation issues a new key immediately and invalidates the old one, so update your environment variables before rotating in production.

Keeping keys safe​

  • Store keys in environment variables or a secret manager, never in Git.

  • Use separate keys for staging and production where possible.

  • Do not embed keys in client-side code, mobile apps, or browser extensions — anyone who views the bundle can read them. Always call OmniScrape from your backend.

Proxy credentials​

When you use residential proxies directly (not through the scrape API), you get a dedicated proxy username and password in Dashboard → Proxies. They are separate from your API key.

Free-trial accounts cannot view or use direct proxy credentials. Proxy is still used automatically when you call Web Unlocker or BaaS. To unlock direct access, activate PAYG (minimum $5 top-up) or subscribe to a paid plan.

Gateway host: proxy.omniscrape.io

| Protocol | Port |

|---|---|

| HTTP | 8080 |

| HTTPS | 8443 |

| SOCKS5 | 1080 |

Country targeting: append _country-<CC> to the proxy username (e.g. os_user_country-DE). See Proxies.

Rotating proxy credentials​

Unlocked accounts can rotate the proxy password from the dashboard or with a session-authenticated request:


POST /auth/rotate-proxy-credentials

The username is unchanged; only the password is regenerated. Trial accounts receive 402 with code PROXY_LOCKED.

Errors​

A missing or invalid key returns 401:


{ "success": false, "error": "Invalid or missing API key" }

See Errors for the full list of status codes.