Authentication

All API requests require authentication via an org-scoped API key. Each key grants access to a single organization's robots, runs, and captures. Requests without a valid key receive a 401 Unauthorized response.

Getting your API key

1. Sign in to the Extralt dashboard
2. Select your organization
3. Navigate to API key settings
4. Create a new API key

API keys are org-scoped. Each key is tied to a specific organization. If you have multiple organizations, generate a separate key for each.

Using your API key

Include your API key in the Authorization header as a Bearer token:

Authorization: Bearer your-api-key

Example request

curl "https://api.extralt.com/robots" \
  -H "Authorization: Bearer your-api-key"

Base URL

All API requests use:

https://api.extralt.com

Security

• Store keys in environment variables or a secrets manager
• Rotate keys periodically
• Revoke compromised keys immediately from the dashboard
• Each key is scoped to one organization and cannot access other orgs' data

Error responses

If authentication fails, the API returns a 401 Unauthorized response:

{
  "error": "Unauthorized",
  "message": "Invalid or missing API key"
}

See Error Codes for the full error catalog.

Next steps

• Making Requests — request and response conventions
• Common Patterns — pagination, filtering, and polling