Authentication
How requests are authenticated, and how keys are issued today.
Every request needs a key in the X-API-Key header:
curl 'https://api.fluxcrawl.dev/v1/tiktok/profile?username=tiktok' \
-H 'X-API-Key: YOUR_KEY'Missing or invalid keys get a 401 with INVALID_API_KEY. Keep live keys
server-side — never call Fluxcrawl directly from a browser or mobile app
with a key embedded in the client.
Keys are issued manually right now
There's no self-serve signup or dashboard yet — Fluxcrawl is pre-launch. Keys are minted by hand during early access. If you don't have one, ask directly rather than looking for a "create key" button; there isn't one yet.
What a key does today
- Gates every request — no key, no response.
- Can be revoked independently without affecting anyone else's key.
- Is never stored in reversible form: only its hash lives in the database, so a key is shown exactly once when it's created.
What it doesn't do yet
Credits are reported (meta.credits_used on every response) but not
actually deducted from anything — there's no balance or billing yet. That's
real scope, deliberately built after a pricing model is finalized rather
than estimated in advance.
{ "meta": { "credits_used": 1 } }A provider failure never counts as billable usage — if Fluxcrawl's fallback
chain exhausts every provider for a platform/endpoint, you get a
PROVIDER_UNAVAILABLE error, not a charge. See Errors.