Authentication

Every request to the RankParse API is authenticated with an API key sent in the X-API-Key header. There are no OAuth flows or bearer tokens for REST calls.

Send your key

curl "https://api.rankparse.com/v1/backlinks?domain=stripe.com" \
  -H "X-API-Key: $RANKPARSE_API_KEY"

import os
import requests

resp = requests.get(
    "https://api.rankparse.com/v1/backlinks",
    params={"domain": "stripe.com"},
    headers={"X-API-Key": os.environ["RANKPARSE_API_KEY"]},
)
resp.raise_for_status()

const resp = await fetch(
  "https://api.rankparse.com/v1/backlinks?domain=stripe.com",
  { headers: { "X-API-Key": process.env.RANKPARSE_API_KEY } },
);
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);

The key must be in the header. Keys in the query string are not read. The header name is case-insensitive.

Key format

Create a key

1. Open Dashboard, Keys at rankparse.com/dashboard/keys.
2. Click New key, give it a name such as production-worker, and click Create.
3. Copy the key immediately and store it in your secret manager.

RankParse emails the creator when a key is created or revoked, so unexpected keys are easy to spot. Every account starts with 100 free credits, so you can make calls right away. See Quickstart.

Revoke or rotate a key

Revocation is immediate: the next request with that key returns 401. Open Dashboard, Keys, choose Revoke on the key, and confirm.

To rotate without downtime:

1. Create a new key with a new name.
2. Deploy it to your service.
3. Check that traffic works, then revoke the old key.

Programmatic key management (GET /v1/keys, POST /v1/keys, DELETE /v1/keys/:id) is documented under Account.

Keys, workspaces and roles

• A key belongs to a workspace, and its calls spend that workspace's credits.
• A key acts with the permissions of the person who created it. If that person is removed from the workspace, or their role cannot use API keys, their keys stop working.
• Members manage their own keys. Owners and admins can see and revoke every key in the workspace.
• Each key has its own rate limit of 60 requests per minute.

Authentication errors

A missing, unknown or revoked key returns 401 with the code invalid_api_key:

{
  "error": "Unauthorized",
  "code": "invalid_api_key",
  "message": "X-API-Key header required"
}

{
  "error": "Unauthorized",
  "code": "invalid_api_key",
  "message": "Invalid or revoked API key"
}

Authentication is checked first. A request with a bad key never reaches rate limiting or billing, so it is never charged. See Errors for the full catalog.

Keep keys secret

• Server side only. Never put a key in browser code, a mobile app, a public repository or a client-side bundle. The API allows cross-origin requests, which makes it easy to call from a browser but also means a leaked key can be used from anywhere.
• Use environment variables or a secret manager. Do not hardcode keys.
• Use one key per service or environment. If one leaks, you revoke one key. Separate keys also have separate rate limits.
• Keep keys out of logs. Redact the X-API-Key header in request logging.
• Revoke immediately if exposed. Revoking is free and instant, and you can create a replacement at once.
• Set a spend cap so a leaked key cannot drain more than a known amount of credits per month.

export RANKPARSE_API_KEY="rp_your_key"

.env
.env.local

Other ways to connect

See MCP server for setup, and Approval inbox for how agent actions that change things wait for your approval.

Related