NEWScrapingAnt MCP for Claude Code, Cursor & Windsurf — try it free →
Skip to main content
Version: v2

Reset (rotate) your API key

Reset your ScrapingAnt API key if you think it may have leaked.

Your API key (also called the API token) is the only credential needed to send requests on your account, and every request it makes spends your API credits. Treat it like a password.

Supply-chain attacks and breaches of third-party services have become common lately. If you have stored your ScrapingAnt API key in a tool, CI system, hosting platform, package, or SaaS integration that reported a security incident, reset the key now rather than wait to see whether it gets abused.

When to reset your API key​

Reset the key if any of these apply:

  • A service, CI system, or dependency that had access to your key reports a compromise.
  • The key was committed to a Git repository, pasted into a public issue or chat, or appeared in logs or screenshots.
  • A teammate or contractor who knew the key no longer works with you.
  • Your usage shows requests you don't recognise.

Even without an incident, rotating the key from time to time is good practice.

How to reset your API key​

  1. Sign in and open your Profile page.
  2. In the Account security section, click Regenerate token under the API token field.
  3. Copy the new token shown in the API token field.

The change applies right away when you click the button. There is no confirmation step, so get ready to update your integrations first.

After the reset:

  • Your previous key is replaced by the new one and is no longer accepted by the API. Requests that still use it will fail with a 403 error (see Errors).
  • We send an email to your account address to let you know the API token was changed. If you get that email and didn't reset the key yourself, change your account password on the same Profile page and contact us.

Residential and datacenter proxy plans use a separate username and password, not your API key. To rotate those, see Reset your proxy credentials.

Update everything that uses the old key​

Put the new key everywhere the old one was used, for example:

Keep your API key safe​

  • Store the key in environment variables or a secrets manager, not in source code.
  • Never commit it to a repository. If it was ever committed, reset it: removing the commit does not remove it from forks, clones, or caches.
  • Don't call the API with your key from client-side code (browser JavaScript or mobile apps), where anyone can read it. Send requests from your backend instead.
  • Share the key only with services you trust, and reset it when you stop using one.