Accounts and API keys

Email sign-in and sessions

AIHackr is an account-based service. Email verification creates or opens your private workspace. Codes expire after 10 minutes and allow five attempts. Sessions last up to seven days; signing out revokes that session. Use the website to sign in rather than scripting its internal authentication routes.

API key authentication

Send your customer key in the Authorization header for REST and MCP. Keys share the same account allowance and crawl ownership as your website session.

Authorization: Bearer YOUR_AIHACKR_API_KEY

Create and revoke keys from API keys in the playground. You can have up to five active keys. Revocation stops future requests with that key. It does not delete your existing crawl results.

Keep credentials server-side

• Use environment variables or your deployment platform’s secret store.
• Never place a key in a public repository, browser bundle, URL or screenshot.
• Use a separate named key for each integration so you can revoke it independently.
• If a key leaks, revoke it and create a replacement.
• Do not send Cloudflare credentials. AIHackr manages the browser infrastructure.

OAuth status

Hosted OAuth account linking is not enabled on the current production service. An implementation is being tested separately. Use a customer API key with a compatible MCP client today. Do not enter your AIHackr key into an untrusted third-party application.

Workspace ownership

Your session and keys reach the same private workspace. Another customer cannot read or cancel your crawl by knowing its ID. Changing keys does not reset trial usage. See usage and retention before building scheduled jobs.