> ## Documentation Index
> Fetch the complete documentation index at: https://docs.url2llm.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate product requests and understand organization access.

Send an organization API key in the API request's authorization header:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

This authenticates `POST /v1/scrape`, `POST /v1/map`, and `POST /v1/quote`. Every key belongs to one organization, and requests spend from that organization's shared credits.

## Key scopes

A key needs `scrape` for scrape and quote, and `map` for site discovery. A valid key missing the required scope receives `403`. [API keys](https://docs.url2llm.com/account/api-keys.md) explains creation, narrower scopes, reveal, rotation, and revocation.

Both `u2l_live_` and `u2l_test_` keys authenticate product requests. The test prefix does not bypass billing or organization limits.

## User sessions

[Dashboard](https://docs.url2llm.com/account/dashboard.md) account endpoints require a signed-in user session scoped to the active organization. The user's role controls administrative operations. Organization owners and admins can manage keys and billing; other memberships may have more limited access.

A user session cannot replace a product API key on scrape, map, or quote. An API key cannot authenticate account endpoints or grant dashboard membership. The Playground signs you in first, then uses a revealed organization key for product requests.

## Keep credentials separate

Store API keys in server-side configuration or a secret manager. Keep them out of public repositories, browser bundles, URLs, and logs. Use separate keys for separate services so one can be revoked independently.

Your url2llm authorization belongs in the API request header. The scrape body's `headers` object is sent to the target site; do not put your url2llm key there.

## Diagnose authentication failures

| Response | Check |
| - | - |
| `401` | Missing, malformed, invalid, or revoked credential |
| `403` on a product endpoint | API key scope, or a user session sent instead of a key |
| `403` on an account endpoint | User session and the required organization role |

Check the active organization when a dashboard action is unavailable. Product requests use the key's organization regardless of the organization selected in your browser. See [organizations](https://docs.url2llm.com/account/organizations.md) and [errors and limits](https://docs.url2llm.com/guides/errors.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.