Getting started

Authentication

Every request is authenticated with an API key sent in a header. Keys carry a tier and a monthly quota.

API key header

Send your key in the X-API-Key header on every request (an Authorization: Bearer <key> header also works). There is no OAuth flow; the key alone identifies and authorizes the caller.

header

X-API-Key: sk_xxxxxxxxxxxxxxxxxxxxxxxx

example

curl "https://serp-api.hoangha.shop/v1/usage" \
  -H "X-API-Key: sk_..."

A missing or invalid key returns 401 Unauthorized. See Errors.

Creating & revoking keys

Keys are minted from the SERP API dashboard. When a key is created, the full raw value is shown once — copy it then, because only a hash is stored server-side and it cannot be shown again. Revoke a key at any time; revoked keys stop working immediately.

Rotate, don’t share

Issue a separate key per environment or integration so you can revoke one without disrupting the others.

Tiers & quotas

Each key carries a tier, a monthly_quota (requests per calendar month), and a per-minute rate limit. A cached result does not consume quota. Check your current consumption at any time:

GET/v1/usage

response

{
  "tier": "pro",
  "monthly_quota": 10000,
  "used_this_month": 1342,
  "remaining": 8658,
  "rate_limit_per_min": 120
}

When the monthly quota is exhausted, requests return 429 with detail monthly quota exceeded. A monthly_quota of 0 means unlimited (no monthly cap). Full detail on Usage & quotas.

Keep keys server-side

Never expose a key in the browser

The key grants full access to your quota. Call the SERP API from your backend and proxy results to your frontend; do not embed the key in client-side code, mobile apps, or public repositories. If a key leaks, revoke it and mint a new one.