Skip to main content
Send an organization API key in the API request’s authorization header:
This authenticates POST /v1/scrape, POST /v1/map, and POST /v1/quote. Every key belongs to one organization, and requests spend from that organization’s shared credits.

​
Key scopes

A key needs scrape for scrape and quote, and map for site discovery. A valid key missing the required scope receives 403. API keys explains creation, narrower scopes, reveal, rotation, and revocation. Both u2l_live_ and u2l_test_ keys authenticate product requests. The test prefix does not bypass billing or organization limits.

​
User sessions

Dashboard account endpoints require a signed-in user session scoped to the active organization. The user’s role controls administrative operations. Organization owners and admins can manage keys and billing; other memberships may have more limited access. A user session cannot replace a product API key on scrape, map, or quote. An API key cannot authenticate account endpoints or grant dashboard membership. The Playground signs you in first, then uses a revealed organization key for product requests.

​
Keep credentials separate

Store API keys in server-side configuration or a secret manager. Keep them out of public repositories, browser bundles, URLs, and logs. Use separate keys for separate services so one can be revoked independently. Your url2llm authorization belongs in the API request header. The scrape body’s headers object is sent to the target site; do not put your url2llm key there.

​
Diagnose authentication failures

Check the active organization when a dashboard action is unavailable. Product requests use the key’s organization regardless of the organization selected in your browser. See organizations and errors and limits.