Crawl4Ai Authentication

generated: '2026-08-29'
method: searched
source: >-
  https://gate.crawl4ai.com/llms.txt, https://gate.crawl4ai.com/docs,
  https://github.com/unclecode/crawl4ai-cloud-sdk (endpoint + error reference),
  https://docs.crawl4ai.com/core/self-hosting/
provider: Crawl4AI
providerId: crawl4ai
description: >-
  Crawl4AI authenticates with bearer API keys on both hosted surfaces and with a
  server-minted JWT on the self-hosted Docker server. There is no OAuth on any
  API: the only OAuth in the product is GitHub/Google sign-in for the human
  dashboard, which issues no API token to third parties. No published OpenAPI
  declares these schemes — every field below is read from the provider's own docs.
schemes:
  - id: gate-bearer
    api: Crawl4AI Cloud API
    type: apiKey
    style: bearer
    in: header
    header: Authorization
    format: 'Bearer sk_live_...'
    alternate:
      in: header
      header: x-api-key
      format: 'sk_live_...'
    key_prefix: sk_live_
    scopes: none
    obtain: >-
      Click "Get a key" at https://gate.crawl4ai.com/ — a 24-hour Play key is
      issued instantly with no signup; verify your email to keep it permanently.
    rotate: https://gate.crawl4ai.com/dashboard/
    verified:
      probe: 'POST https://gate.crawl4ai.com/scrape with no credential'
      status: 401
      body_length: 0
      date: '2026-08-29'
  - id: v1-api-key
    api: Crawl4AI Cloud v1 API
    type: apiKey
    in: header
    header: X-API-Key
    scopes: none
    env_var: CRAWL4AI_API_KEY
    obtain: https://gate.crawl4ai.com/dashboard/
    note: >-
      The v1 API on api.crawl4ai.com uses the X-API-Key header rather than the
      Authorization bearer of the gate surface. 401 is documented as "Missing
      X-API-Key header, invalid/expired key".
  - id: selfhosted-jwt
    api: Crawl4AI Self-Hosted Docker API
    type: http
    style: bearer
    in: header
    header: Authorization
    format: 'Bearer <token>'
    token_endpoint: 'POST /token'
    scopes:
      - admin
    note: >-
      Since 0.9.0 authentication is ON BY DEFAULT. With no CRAWL4AI_API_TOKEN the
      server binds 127.0.0.1 and prints a one-off local token; exposing it requires
      setting CRAWL4AI_API_TOKEN and sending a bearer on every request except
      GET /health. The JWT implementation changed in 0.9.0 and all pre-0.9.0
      tokens were invalidated. Monitor mutations (POST /monitor/actions/*,
      /monitor/stats/reset) require an admin-scope principal.
    docs: https://docs.crawl4ai.com/core/self-hosting/
dashboard_sign_in:
  type: oauth2
  providers:
    - GitHub (GET /v1/auth/github/start)
    - Google (GET /v1/auth/google/start)
  note: >-
    Human sign-in to the Crawl4AI dashboard only. No authorization-code flow is
    published for third-party API access, no /.well-known/oauth-authorization-server
    is served (probed 404, 2026-08-29), and no scope vocabulary exists — which is
    why no scopes/ artifact is written for this provider.
mtls: false
openid_connect: false
key_handling:
  storage_guidance: >-
    Terms of Service §3 makes the account holder responsible for all activity
    under their keys and requires prompt notification of a compromised key.
  env_vars:
    - CRAWL4AI_KEY
    - CRAWL4AI_URL
    - CRAWL4AI_API_KEY
    - CRAWL4AI_API_TOKEN
failure_modes:
  - status: 401
    meaning: Missing or invalid key
  - status: 403
    meaning: Plan does not allow this feature, or caller is not the resource owner
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com