• Authorization: Bearer <key> names an organization. Without the header the caller is anonymous, counted by IP; an unknown or revoked key, or a scheme other than Bearer, is a 401 UNAUTHORIZED.
  • An OAuth access token, which an MCP client gets by signing in, works only on /mcp. The REST API answers it 401 INVALID_ACCESS_TOKEN and needs an API key.
  • Anonymous callers only scrape (POST /v2/scrape, GET /{url}), with a body of at most 64 KiB, and read the status of a scrape that answered 202 by its id. Every batch scrape endpoint but the download answers them 401 API_KEY_REQUIRED.
  • An organization’s scrapes and batch scrapes are its own: another organization’s is a 404, for a status and a cancel alike. An anonymous scrape is a 404 to an organization, and an organization’s to an anonymous caller.
  • Every URL an organization submits costs 1 credit, scrapes included, taken from its prepaid balance when the request is accepted. Anonymous callers pay nothing. A balance that does not cover the request’s credits is a 402 INSUFFICIENT_CREDITS: nothing is queued, though the URLs still count toward the quota below. Every result that is not ok gives its credit back, a target’s 404 or 500 and a proxy_error included, and so does every cancelled URL. An Idempotency-Key replay costs nothing.
  • Per-minute quotas, past which the answer is 429 with Retry-After: anonymous scrapes 10 URLs and anonymous status reads 60; an organization’s scrapes 600 URLs, its batch scrapes 50,000 URLs (also the most URLs per request) and its status reads 600 (each status, download, cancel or replay). Quotas and idempotency keys are per organization, shared by its keys.
  • Each scrape and each batch scrape also has 10 result reads an hour, whoever reads it: a scrape’s status read that carries its document, and every package download. Past it the answer is 429 with Retry-After too.