API keys & access
How create and get search authenticate a dashboard API key.
Create and get search require a dashboard API key:
Authorization: Bearer srcly_…Keys are created in the dashboard. This API does not issue them. Send the same key when you retrieve a search. The key is a credential; it is different from the job_id returned by a search.
A missing, malformed, revoked, or expired key returns 401 with error.code: "invalid_api_key". No search is created. If this API cannot complete verification, it returns 503 with error.code: "service_unavailable" and does not run the search.
Ownership
The account that owns the key owns the search. Another key on the same account can retrieve it. A key from a different account receives 404 job_not_found, the same response as an unknown ID. Polling does not record another billable request.
Key handling
Keep API keys on your server, in environment configuration or a secret manager. Do not ship private keys in frontend bundles or place them in URLs. The plaintext key is shown once, when the dashboard creates it. Revoke a lost key there and create a new one.
Rate limits
Limits are counted per API key, after the key is accepted. A rejected request does not start a search.
| Operation | Limit |
|---|---|
| Create a search, including later page and claim updates | 10 per minute and 100 per hour |
| Read or delete a search | 120 per minute and 4,000 per hour |
Exceeding either window returns 429 with error.code: "rate_limit_exceeded" and a Retry-After header in seconds. Wait that long, then retry the same request. Polling every two seconds stays inside the read limit. These numbers are not a concurrency cap; a separate concurrency limit is not enforced yet.