Authentication

API keys

SerpKite keys look like skt_live_ followed by a random secret. You create them in the dashboard at app.serpkite.com under API keys. The full secret is shown exactly once, when the key is created or rotated. We store only a SHA-256 hash of it, so nobody at SerpKite can read it back to you. If you lose a key, rotate it.

The skt_ prefix is deliberate: it doesn’t collide with Stripe’s sk_ pattern, so secret scanners (GitHub push protection and similar) can tell a leaked SerpKite key apart from a Stripe one.

An account can have several keys, each with its own name and optional monthly credit limit. See API keys.

Sending the key

Send the key as a Bearer token in the Authorization header. This works on every request, including the MCP server:

Other headers are not read. A request without a valid Authorization: Bearer header (or api_key on a GET) gets 401 unauthorized.

Bearer token

The official SDKs send the header for you and read the key from SERPKITE_API_KEY unless you pass one explicitly (new SerpKite({ apiKey }), SerpKite(api_key=...), serpkite.WithAPIKey(...)). With curl or your own HTTP client, set the header yourself:

curl https://api.serpkite.com/v1/search \
  -H "Authorization: Bearer $SERPKITE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q":"best espresso machine 2026","country":"us","language":"en"}'

Query parameter (GET only)

For GET requests you can put the key in the URL as api_key. This exists for tools that can only paste a URL (spreadsheets, no-code HTTP nodes). The Custom Search–compatible endpoint also accepts Google’s key=, so existing CSE clients keep working.

curl "https://api.serpkite.com/v1/search?q=best+espresso+machine+2026&country=us&api_key=$SERPKITE_API_KEY"

Keep keys secret

• Load the key from an environment variable or a secrets manager. All examples in these docs read SERPKITE_API_KEY.
• Don’t ship keys in mobile apps or public frontend bundles. The API sends Access-Control-Allow-Origin: * so that a browser playground with the user’s own key works, but anyone who can read your JavaScript can read a key embedded in it. Call SerpKite from your backend instead.
• Use one key per environment or service (production, staging, n8n) and give each a monthly credit limit. A leaked key then has a bounded cost, and you can revoke it without touching the others.
• If a key leaks, rotate or revoke it in the dashboard. Revocation is effective within about a minute.

Checking a key

GET /v1/account is free and returns the balance, rate limit and this month’s usage for the account behind the key. It is a cheap way to validate a key at startup:

curl "https://api.serpkite.com/v1/account" \
  -H "Authorization: Bearer $SERPKITE_API_KEY"

A missing, malformed or revoked key gets 401 unauthorized:

{
  "error": {
    "code": "unauthorized",
    "message": "invalid or revoked API key",
    "request_id": "req_01J8ZK9P3WQ5N"
  }
}

The SDKs raise this as an error you can catch: SerpKiteError in TypeScript and Python (with status, code, message and the request ID), *serpkite.Error in Go. Check for code === "unauthorized" rather than parsing the message.

The dashboard itself (app.serpkite.com) uses a separate session cookie, not API keys. API keys only work against api.serpkite.com.

Related