Authentication

Create an account and verify your email in the RunHarvester Console at app.runharvester.com. Create a Data API key from the API keys screen and copy its secret immediately: the full secret is shown once. Store it in a server-side secret manager and rotate or revoke it from the Console when needed.

RunHarvester has three credential contexts:

Credential	Header	Use	Scopes
Data API key	`X-API-Key: rh_live_...`	Server-side Data API requests under `/api/v1/data`	`scrape:write`, `requests:read`
Client / Management session	`Authorization: Bearer <USER_JWT>`	Console and account-management routes under `/api/v1/client`	Controlled by the signed-in user/session
Browser Workflow API key	`X-API-Key: ...`	Server-to-server workflow data routes under `/api/v1/browser/...`	Workflow scopes such as `runs:read`, `runs:write`, `evidence:read`, `cdp:connect`

Do not use a Data API key to call client JWT routes, or a Browser Workflow key to call the Data API.

X-API-Key: rh_live_replace_me

For a signed-in client session, use the user JWT rather than an API-key secret:

Authorization: Bearer <USER_JWT>

The MCP endpoint has its own connection examples, including API keys supplied as bearer tokens. Do not confuse that transport convention with a client-session JWT.

Data API keys normally need scrape:write to submit work and requests:read to inspect jobs and results. Use the smallest scope set that supports the integration. The Console creates the key with these scopes and never returns the secret from list or usage endpoints.

Some accounts require a verified email before public Data API use. Treat EMAIL_VERIFICATION_REQUIRED and EMAIL_NOT_VERIFIED as account-action errors, not transient request failures. See errors for the response shape.

The API playground makes direct browser requests to https://api.runharvester.com; this portal does not proxy playground traffic. See Security and privacy for CORS and browser-integration guidance.