Authentication

API key (recommended for servers)

Create a key in Settings → API keys and send it in the X-API-Key header:

curl https://api.orbicrawl.com/api/v1/leads \
  -H "X-API-Key: oc_live_..."

• Keys are shown once at creation — store them securely.
• Revoke a key any time from the dashboard; revocation is immediate.
• API keys are for data endpoints (jobs, leads, exports, AI). They are intentionally blocked from admin, billing and account-security actions — those require an interactive session.

Bearer token (dashboard / SPA)

The web app authenticates with a short-lived (15-minute) access token via Authorization: Bearer <token>, refreshed automatically through an HttpOnly cookie. You normally don't handle these directly — use an API key for scripts.

curl https://api.orbicrawl.com/api/v1/leads \
  -H "Authorization: Bearer <access_token>"

Errors

Failures return a uniform envelope:

{ "error": { "code": "unauthorized", "message": "invalid API key" } }