Crawle
Log inStart monitoring

Authentication

Authenticate with an API key or an OAuth access token, and grant only the scopes you need.

On this page

Every request needs a bearer token in the Authorization header: an API key for scripts that only read, or an OAuth access token when a person connects an integration or an AI agent.

API keys

Create an API key in the app under Settings › API keys. A key belongs to one workspace and can only read.

Request headerHeader
Authorization: Bearer crw_live_EXAMPLE_DO_NOT_USE
  • Grant only the scopes your script needs.
  • Store keys in a secret manager, never in a repository or browser client.
  • Rotate keys when teammates, vendors, or automation ownership changes.
  • An API key that calls an endpoint which writes gets HTTP 403.

OAuth access tokens

Integrations and AI agents that act for a person use OAuth 2.0 authorization codes with PKCE. Access tokens start with crw_oauth_at_.

  • Writes and team management need an OAuth access token.
  • The person must also hold the role an endpoint names: editor, or owner or admin.
  • A token works in one workspace at a time.
  • People can review and revoke connected apps in the app under Settings › Connected apps.

Scopes

A token carries scopes. Each endpoint lists the scopes that let you call it, and any one of them is enough.

  • sites:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    AI readiness, account context, client groups, crawl exclusion rules, effective settings, google, migrations, overview, regions, sitemaps, sites, tags, verification, weekly report settings, weekly reports, workspaces

  • urls:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    URLs, google, segments

  • issues:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    issues, redirect chains

  • alerts:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    alert trigger configs, alerts, custom extractions, incidents, notification settings

  • changes:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    URLs, changes

  • links:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    internal link score, links

  • exports:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    exports

  • historical:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    GSC, historical

  • technology:read

    API keys
    Yes
    OAuth
    Yes
    Used for
    technology

  • workspaces:read

    API keys
    No
    OAuth
    Yes
    Used for
    workspaces

  • account:read

    API keys
    No
    OAuth
    Yes
    Used for
    account context

  • sites:write

    API keys
    No
    OAuth
    Yes
    Used for
    AI readiness, URL submissions, URLs, delete preview, migrations, segments, sitemaps, sites, verification

  • settings:write

    API keys
    No
    OAuth
    Yes
    Used for
    bulk settings

  • alerts:write

    API keys
    No
    OAuth
    Yes
    Used for
    alert policy, alert trigger configs, custom extractions, notification settings

  • exports:write

    API keys
    No
    OAuth
    Yes
    Used for
    exports

  • workspace:write

    API keys
    No
    OAuth
    Yes
    Used for
    client groups, tags

  • team:write

    API keys
    No
    OAuth
    Yes
    Used for
    team

  • technology:write

    API keys
    No
    OAuth
    Yes
    Used for
    technology

  • offline_access

    API keys
    No
    OAuth
    Yes
    Used for
    refresh tokens for hosted connectors

Authentication errors

A missing, wrong, or under-scoped token gets HTTP 401 or 403 with a detail message that says which.

Last updated October 29, 2026