> ## Documentation Index
> Fetch the complete documentation index at: https://docs.messora.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate with X-API-Key, manage credits, and respect rate limits.

# Authentication

All Messora API routes require authentication via the `X-API-Key` header.

## Getting your API key

1. Create an account at [www.messora.dev/auth/signup](https://www.messora.dev/auth/signup)
2. Open **API Keys** in the logged-in area
3. Copy your key — it is shown once; store it securely

## Using the API key

Include the `X-API-Key` header on every request:

```bash theme={null}
curl -X POST https://api.messora.dev/scrape \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"url": "https://example.com", "formats": ["markdown"]}'
```

## Authentication error responses

| Status | Meaning                    |
| ------ | -------------------------- |
| `401`  | Missing `X-API-Key` header |
| `403`  | Invalid or revoked API key |

## Credits

Each operation consumes credits from your monthly balance:

| Operation                | Cost                         |
| ------------------------ | ---------------------------- |
| Scrape (markdown / raw)  | 1 credit per page            |
| Scrape (structured JSON) | 10 credits per request       |
| Search                   | 1 credit per returned result |
| Crawl                    | 1 credit per successful page |

<Note>
  Failures (anti-bot block, timeout, extraction error) do **not** consume credits.
</Note>

## Rate limits

| Endpoint             | Limit                                   |
| -------------------- | --------------------------------------- |
| `POST /scrape`       | 10 req/min                              |
| `POST /search`       | 2 req/min                               |
| `POST /crawl`        | 10 req/min                              |
| `GET /jobs/{job_id}` | No explicit limit (poll about every 2s) |

When the limit is exceeded, the API returns `429 Too Many Requests`. Wait for
the cooldown before sending new requests.