Authentication#
Use either header below with a workspace API key. API keys belong on your server, not in browser bundles or URL query strings. Create a separate key for each integration so you can limit access and revoke it independently.
Authorization: Bearer $LUNI_API_KEY
# Or use this header instead:
X-API-Key: $LUNI_API_KEY| Scope | Allows |
|---|---|
read | Credit usage, operation inspection, job results and monitor details |
scrape | Page scraping, source record extraction and monitor changes and checks |
map | Website URL discovery |
search | Web search and its optional content fetches |
crawl | Crawl submission and cancellation |
company | Company requests where the service is enabled |
Check granted scopes and expiry in API keys. Revoked or expired keys stop authenticating. A valid key with a missing scope returns 403 FORBIDDEN. A key does not enable a service that is unavailable on the server.
Studio generation, saved scrapers and OAuth consent use your signed-in workspace session. API keys do not grant access to those session routes.