API keys

API access is included from Scale. Create keys in Settings → API keys with read-only or read-and-write access. A key is shown once; we store only a hash of it.

Authentication

curl https://www.serpfull.com/api/v1/projects \
  -H "Authorization: Bearer sf_live_…"

Storage

Keys are hashed with HMAC-SHA256 and a server-side secret before they're stored, so nobody at Serpfull can read a key back. Only owners and admins can create or revoke keys, and creating one needs a 2FA-verified session. Read-only keys can call GET endpoints; read & write keys can also create, change and remove search terms.

Revoke a key at any time; requests using it fail straight away.