Authentication
Send your API key on every request, in one of two headers.
Every request needs your API key. Send it in either header:
x-api-key: sk_...Authorization: Bearer sk_...If a request carries both, x-api-key is used and Authorization is ignored.
Examples
curl -s "https://scraper.riken.me/v1/tiktok/profile?handle=example_creator" \
-H "x-api-key: $RIKEN_API_KEY"When the key is wrong
A missing, unknown or revoked key gets 401 unauthorized. It is never charged.
{"success":false,"error":"unauthorized","errorStatus":401,"message":"missing or invalid API key: send x-api-key or Authorization: Bearer","credits_charged":0}Keeping keys safe
- Call the API from your server, not from a browser or mobile app. Anyone who can read the key can spend its credits.
- Each key has its own credit balance, its own idempotency replays and its own free-answer limit.
- Revoke a key in the dashboard the moment it leaks. Revocation takes effect on the next request.
The Try it box
The Try it box on endpoint pages keeps your key in that browser tab only and sends it only to https://scraper.riken.me. Live requests from it spend credits like any other.