Serper Authentication

generated: '2026-08-13'
method: searched
source: >-
  https://serper.dev/api-keys, Serper's own playground bundle
  https://serper.dev/_next/static/chunks/pages/playground-7ce8960e9fe2fc99.js, and live
  probes of google.serper.dev / scrape.serper.dev / api.serper.dev on 2026-08-13
docs: https://serper.dev/api-keys
summary:
  types:
  - apiKey
  api_key_in:
  - header
  - query
  oauth2: false
  oidc: false
  mtls: false
  scopes: none
description: >-
  Serper uses a single static API key. The documented path is an X-API-KEY request header
  on a POST. Serper's own playground can also emit the call as a GET with the key in an
  `apiKey` query-string parameter — a second, weaker convention that puts the credential
  in the URL. There is no OAuth, no OIDC, no scopes, no token exchange and no expiry.
  Keys are created and revoked in the account dashboard at https://serper.dev/api-keys,
  which supports multiple named keys per account.

schemes:
- name: apiKeyHeader
  type: apiKey
  in: header
  parameter: X-API-KEY
  description: >-
    Primary scheme. Sent with Content-Type: application/json on a POST to the search or
    scrape host.
  method: searched
  sources:
  - https://serper.dev/_next/static/chunks/pages/playground-7ce8960e9fe2fc99.js
  - openapi/serper-search-api-openapi.yml

- name: apiKeyQuery
  type: apiKey
  in: query
  parameter: apiKey
  description: >-
    Alternative scheme emitted by Serper's playground when the GET method is selected:
    every body field is promoted to a query parameter and the key is appended as
    `apiKey`. Functional but exposes the credential in URLs, proxy logs and browser
    history. Not represented in any of Serper's published examples as the default.
  method: searched
  sources:
  - https://serper.dev/_next/static/chunks/pages/playground-7ce8960e9fe2fc99.js

key_management:
  console: https://serper.dev/api-keys
  multiple_keys: true
  named_keys: true
  rotation_policy: not published
  expiry: none published
  prefix: none published
  scoping: >-
    Keys are not scoped to endpoints or search types. Any key can call any published
    surface, and any key can spend the whole account credit balance.
  note: >-
    Serper's dashboard exposes a /users/api-keys listing and per-key usage logs, so keys
    can be used as a cost-allocation boundary per team or environment — see
    finops/serper-finops.yml.

unauthenticated_surface:
  - url: https://api.serper.dev/locations?q=<term>&limit=25
    status: 200
    note: >-
      Answers without a key. Linked from Serper's playground as the public list of
      supported location values.
  - url: https://api.serper.dev/health
    status: 200
    note: Public health check.

denial_behaviour:
  status: 403
  body: '{"message":"Unauthorized. Sign up for a free account.","statusCode":403}'
  observed: '2026-08-13'
  note: >-
    The gateway returns 403 (not 401) and returns no WWW-Authenticate header, so a client
    cannot discover the required scheme from the challenge.