Authentication

Public API calls send a secret key in the Authorization header:

Authorization: Bearer sk_live_…

cURL

curl "https://api.serpresult.com/v1/query?query=serp+api" \
  -H "Authorization: Bearer sk_live_your_key"

Node

const response = await fetch(
  "https://api.serpresult.com/v1/query?" + new URLSearchParams({ query: "serp api" }),
  { headers: { Authorization: `Bearer ${process.env.SERP_API_KEY}` } },
);

Python

import os, requests

response = requests.get(
    "https://api.serpresult.com/v1/query",
    headers={"Authorization": f"Bearer {os.environ['SERP_API_KEY']}"},
    params={"query": "serp api"},
    timeout=30,
)

Call GET /v1/me to check a key before you use it. It costs no credits.

Live and test keys

Keys are minted in the dashboard under Developers → API Keys. The plaintext secret is shown once, on creation or rotation, and nowhere else.

Key	Prefix	Rate limit
Live	sk_live_	60 requests a minute
Test	sk_test_	20 requests a minute

A test key is a live key with a lower ceiling: it runs the same searches against the same targets and costs the same credits. Use one while wiring up an integration so a runaway loop hits the limit early.

What a key can reach

A key authenticates GET /v1/query, POST /v1/bulk, GET /v1/me and POST /mcp, the MCP server. An MCP client can instead sign in with OAuth and needs no key at all. The reporting and key-management routes (/v1/usage, /v1/query/recent, /v1/query/history, /v1/api-keys) are session-only: they answer 401 unauthorized to a bearer key. A key that could mint another key would make revoking the first one meaningless, so those live in the dashboard.

Rejected credentials

An unknown, revoked or malformed key answers 401 unauthorized in the standard error envelope. A presented-but-invalid credential never falls through to another auth path.

Rotation and revocation

Rotating a key from the dashboard revokes it and mints a replacement with the same name and type. Both rotation and revocation take effect within a minute. Update the service holding the old secret first.

Other principals

Two more credentials exist and are described in the OpenAPI document, but integrators never send them by hand: the marketing site’s keyless demo header and the RapidAPI marketplace proxy secret. Requests relayed by RapidAPI are authenticated by the proxy, not by a sk_ key.