generated: '2026-08-09'
method: searched
source: openapi/webscraping-ai-openapi.yml
docs: https://webscraping.ai/docs#authentication
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - query
  oauth2_flows:
  - authorization_code
schemes:
- name: api_key
  type: apiKey
  in: query
  parameter: api_key
  description: >-
    All REST API requests require an API key passed as the `api_key` query-string
    parameter. There is no header form documented. The docs warn the key must not be
    exposed in client-side code.
  applies_to: https://api.webscraping.ai
  sources:
  - openapi/webscraping-ai-openapi.yml
  - https://webscraping.ai/docs
- name: proxy_basic_auth
  type: http
  scheme: basic
  description: >-
    Proxy Mode (proxy.webscraping.ai:8888) authenticates with HTTP proxy credentials —
    the username is the API key and the password carries the request parameters
    (e.g. `js=true&proxy=residential`). The proxy presents a self-signed certificate.
  applies_to: http://proxy.webscraping.ai:8888
  sources:
  - https://webscraping.ai/docs
- name: mcp_oauth2
  type: oauth2
  description: >-
    The hosted remote MCP server (https://mcp.webscraping.ai/mcp) is protected by OAuth 2.1
    with PKCE and dynamic client registration — no API key is used. Anonymous requests are
    rejected with 401 and a RFC 9728 `WWW-Authenticate: Bearer resource_metadata=...` challenge.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://webscraping.ai/oauth/authorize
    tokenUrl: https://webscraping.ai/oauth/token
    registrationEndpoint: https://webscraping.ai/oauth/register
    revocationEndpoint: https://webscraping.ai/oauth/revoke
    code_challenge_methods: [S256]
    grant_types: [authorization_code, refresh_token]
    token_endpoint_auth_methods: [none, client_secret_basic, client_secret_post]
    scopes: {}
  sources:
  - well-known/webscraping-ai-oauth-authorization-server.json
  - well-known/webscraping-ai-oauth-protected-resource.json
notes:
- 'The OpenAPI declares a single api_key scheme applied globally — security: [{api_key: []}].'
- No OAuth scopes are published; the authorization-server metadata omits `scopes_supported`,
  so no `scopes/` artifact is emitted rather than inventing one.
- An invalid or missing key returns HTTP 403 (not 401) on the REST API.
x-evidence:
- url: https://webscraping.ai/openapi.yml
  http_status: 200
- url: https://webscraping.ai/.well-known/oauth-authorization-server
  http_status: 200
- url: https://webscraping.ai/.well-known/oauth-protected-resource
  http_status: 200
- url: https://mcp.webscraping.ai/mcp
  http_status: 401