Authentication

Every Grabber API request needs an API key in the Authorization header. How to create a key, send it, keep it safe and read a 401 response.

Last updated October 27, 2026

An API key from https://dashboard.grabber.sh/keys. It starts with gsh_. The header is the only place it is accepted.

Send it as a Bearer token on every request:

Authorization: Bearer gsh_your_api_key

Send the key

Each example reads the key from the GRABBER_API_KEY environment variable.

curl -G https://api.grabber.sh/fetch \
  -H "Authorization: Bearer $GRABBER_API_KEY" \
  --data-urlencode "url=https://example.com/" \
  -d "formats=markdown" \
  -d "unwrap=true"

Only in the header

A key in the address, like ?key=gsh_…, is refused like any other unknown parameter: the answer is 400 invalid_query and the key is not used. Keys in URLs end up in logs and browser history, so Grabber never reads them there.

When the key is wrong

The key is missing, malformed, unknown, or deleted. The answer is 401 with WWW-Authenticate: Bearer, and nothing is charged.

{
  "status": 401,
  "message": "Unauthorized",
  "detail": "invalid_api_key"
}

Keep your key safe

Keep the key on a server or in your agent's environment, never in code that runs in a browser or in a public repository.
Create one key per app or agent. The dashboard shows usage and cost per key, and you can delete one without touching the others.
If a key leaks, delete it in the dashboard. It stops working at once, and the next request with it gets a 401.