```yaml
product: AlterLab
title: "API Authentication — Web Scraping Glossary | AlterLab"
comparison_context: "AlterLab is an alternative to Firecrawl, ScrapingBee, and Bright Data."
source_url: https://alterlab.io/glossary/api-authentication
```

general

# API Authentication

The mechanisms used to verify the identity of callers making requests to an API, typically via API keys, OAuth tokens, or JWT.

API authentication is the process of verifying that a caller making an API request is who they claim to be and is authorised to access the requested resource. The three most common authentication mechanisms for web APIs are: API keys (long secret strings sent in a header or query parameter), OAuth 2.0 (delegated access using short-lived tokens obtained through an auth flow), and JSON Web Tokens (JWT — self-contained tokens that carry claims and are verified via cryptographic signature).

For web scraping, API authentication matters in two scenarios. First, when scraping data from sites that expose their data through authenticated APIs — intercepting the client-side requests to the API requires authenticating as a valid user, which means obtaining session tokens through a login flow or using service account credentials. Second, when using scraping services like AlterLab, which authenticate API callers via API keys passed in the `X-API-Key` header.

Common authentication header patterns: `Authorization: Bearer <token>` (OAuth/JWT), `Authorization: Basic <base64>` (username:password), `X-API-Key: <key>` (API key), `Cookie: session=<id>` (session-based). AlterLab uses the `X-API-Key` pattern with keys prefixed `sk_live_` for production and `sk_test_` for sandbox testing.

### What is API Authentication?

The mechanisms used to verify the identity of callers making requests to an API, typically via API keys, OAuth tokens, or JWT.

### How does AlterLab handle API Authentication?

Common authentication header patterns: `Authorization: Bearer <token>` (OAuth/JWT), `Authorization: Basic <base64>` (username:password), `X-API-Key: <key>` (API key), `Cookie: session=<id>` (session-based). AlterLab uses the `X-API-Key` pattern with keys prefixed `sk_live_` for production and `sk_test_` for sandbox testing.

## Examples

```
# API key authentication
curl -X POST https://api.alterlab.io/v1/scrape \
  -H "X-API-Key: sk_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'
```

## Related Terms

[REST APIA web service that exposes data and actions through standard HTTP methods and resource-oriented URLs, returning structured JSON responses.](https://alterlab.io/glossary/rest-api)[Session ManagementThe handling of cookies, authentication tokens, and browser state across multiple requests to maintain a continuous browsing session.](https://alterlab.io/glossary/session-management)[Web ScrapingAutomated extraction of data from websites using software tools that parse HTML and collect structured information at scale.](https://alterlab.io/glossary/web-scraping)

## Extract API Authentication data from any website

AlterLab returns clean, structured data from any public URL — no scraper infrastructure needed. Start free, no credit card required.

[View API docs](https://alterlab.io/docs/api/rest)

[Back to Glossary](https://alterlab.io/glossary)