Authentication

Every method except getQueueStats and getTaskTypes takes your API key in the clientKey field of the JSON body. No headers, no tokens to refresh.

{
  "clientKey": "0123456789abcdef0123456789abcdef"
}

Where to get a key#

1. Sign up and confirm your email — live keys need a confirmed email.
2. Open Dashboard → API keys and create a key: choose the mode (live or test), a name, and optionally limits and an IP allowlist.
3. Copy the key at once: it is shown in full only when it is created. We store only a hash; you can rotate or revoke the key at any time.

A key is 32 lowercase hex characters — the format of Anti-Captcha and 2Captcha keys, so SDKs that validate keys accept it. An account can have up to 20 active keys.

Live and test keys#

Key settings#

• Parallel tasks — how many tasks of the key may be in progress at once (default 200). Above it createTask returns ERROR_NO_SLOT_AVAILABLE.
• Spending caps — daily and monthly limits in USD. Above them createTask returns ERROR_SPENDING_LIMIT.
• IP allowlist — up to 50 IPv4/IPv6 addresses or CIDR ranges. Requests from other addresses get ERROR_IP_NOT_ALLOWED.
• Changes and revocations reach the API within about 15 seconds.

Keep the key secret#

• Call the API from your server. The JSON API sends no CORS headers, so other sites cannot call it from a browser — and a key in front-end code would be visible to anyone.
• Keep keys in environment variables or a secret manager, not in the repository.
• Use a separate key per project or server: you see their spending separately and can revoke one without touching the others.
• If a key leaks, rotate it in the dashboard: the old key stops working at once.