API Authentication
The Website Categorization API uses API keys for authentication. Every request must include your API key in the Authorization header using the Bearer token scheme. This ensures secure access to the API while allowing you to track usage and manage access credentials.
Getting Your API Key
After creating your account, you can access your API key from the dashboard:
- Log in to your account at the dashboard
- Navigate to the API Keys section
- Copy your API key (starts with "wca_")
Making Authenticated Requests
Include your API key in the Authorization header of every request:
curl -X GET "https://api.websitecategorizationapi.com/v1/categorize?domain=example.com" \
-H "Authorization: Bearer YOUR_API_KEY"
Example in different languages:
Python
import requests
headers = {
"Authorization": "Bearer YOUR_API_KEY"
}
response = requests.get(
"https://api.websitecategorizationapi.com/v1/categorize?domain=example.com",
headers=headers
)
JavaScript
const response = await fetch(
"https://api.websitecategorizationapi.com/v1/categorize?domain=example.com",
{
headers: {
"Authorization": "Bearer YOUR_API_KEY"
}
}
);
Security Warning
Never expose your API key in client-side code, version control, or public repositories. API keys provide full access to your account and usage quota. Treat them like passwords.
Authentication Errors
The API returns specific error codes for authentication issues:
// 401 Unauthorized - Invalid or missing API key
{
"error": "unauthorized",
"message": "Invalid API key provided"
}
// 403 Forbidden - API key lacks required permissions
{
"error": "forbidden",
"message": "Your plan does not include access to this endpoint"
}
Security Best Practices
Use Environment Variables
Store your API key in environment variables rather than hardcoding it in your application:
# Set environment variable
export WCA_API_KEY="your_api_key_here"
# Access in Python
import os
api_key = os.environ.get("WCA_API_KEY")
# Access in Node.js
const apiKey = process.env.WCA_API_KEY;
Rotate Keys Regularly
Generate new API keys periodically and revoke old ones. This limits the impact if a key is compromised. You can generate new keys from your dashboard without service interruption.
Use Separate Keys per Environment
Create separate API keys for development, staging, and production environments. This allows you to track usage by environment and revoke individual keys if needed.
Server-Side Only
Make API calls from your server, never directly from client-side JavaScript. If you need client-side functionality, create a proxy endpoint on your server that handles authentication.
Monitor for Anomalies
Review your API usage regularly for unusual patterns that might indicate a compromised key. Set up usage alerts in your dashboard to be notified of unexpected spikes.