## API keys

All public endpoints authenticate with a Bearer key:

```
Authorization: Bearer ac-<32 hex chars>
```

Create and revoke keys in the dashboard (**API Keys**) or programmatically via
`POST /v1/account/keys`. The full key is returned **once** at creation — only the
`key_prefix` is stored and displayed afterwards.



> **Warning:** Playground keys (`kind = "playground"`) are provisioned automatically for the
in-product playground and are rejected with `403 FORBIDDEN` on direct API access.
Use a regular key for your integrations.



## Idempotency

`POST /v1/crawl` accepts an `Idempotency-Key` header. Retrying a request with the
same key never creates a second job — use it whenever a submission might be retried
by your client or queue.

## Pagination

List endpoints use **keyset pagination**, ordered `created_at DESC, id DESC`:

- Pass `?cursor=<next_cursor>` + `?limit`.
- `next_cursor` (or `next`) is `null` at the end of results.
- Cursors are opaque and strictly validated — a malformed cursor returns `400`.