> ## Documentation Index
> Fetch the complete documentation index at: https://docs.api.nickautomations.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate your requests to the LinkedIn Scraper API using API keys.

# Authentication

The LinkedIn Scraper API uses API keys to authenticate every request. There are no OAuth flows or session tokens — just a single header.

## Including your API key

Pass your API key in the `x-api-key` header on every request:

```bash theme={null}
curl -X POST https://api.nickautomations.com/linkedin/scrape \
  -H "x-api-key: <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{ ... }'
```

<Note>
  The `x-api-key` header is required on all `/scrape` requests. Health and metrics endpoints do not require authentication.
</Note>

## Getting an API key

API keys are issued by the API provider. If you do not have one yet, contact your provider to request access. Each key has:

* A **rate limit** (requests per second) specific to your account
* An **expiration date** after which the key stops working

## Error responses

If authentication fails, you'll receive a `401` or `403` response:

| Status | Meaning                                  | What to do                                                  |
| ------ | ---------------------------------------- | ----------------------------------------------------------- |
| `401`  | API key header missing                   | Add the `x-api-key` header to your request                  |
| `403`  | API key is invalid, expired, or inactive | Contact your provider to get a new key or resolve the issue |

Example `401` response:

```json theme={null}
{
  "detail": "Missing x-api-key header"
}
```

Example `403` response:

```json theme={null}
{
  "detail": "Invalid or expired API key"
}
```

## Keeping your key safe

<Warning>
  **Never commit your API key to version control** or include it in client-side code that runs in a browser. Treat it like a password.
</Warning>

Best practices:

* Store your key in an environment variable (e.g., `LINKEDIN_API_KEY`)
* Rotate your key periodically — contact your provider to issue a new one
* Do not share your key across multiple applications if they have different rate-limit needs

## Next steps

* [Quickstart](/guides/quickstart) — see the API key in action
* [Rate Limiting](/guides/rate-limiting) — understand your per-key request limits
* [Scrape API Reference](/api-reference/scrape) — full endpoint documentation