Getting started

Authentication

Every SubReply API endpoint authenticates the same way: a personal API key, sent as a Bearer token.

There is no OAuth, no session cookie and no request signature. One key identifies exactly one SubReply account: that account is the one being charged and the one whose balance is checked.

Header

Authorization: Bearer sr_live_VOTRE_CLE_API

Generate a key

Open the API keys page of your dashboard.
Name the key after the tool that will use it (« n8n prod », « scraping script »…). That name is how you revoke the right one later.
Copy the token immediately: it will never be readable again.

Generate my API key

Key format

A key is the sr_live_ prefix followed by 64 hexadecimal characters — 72 characters in all, so 256 bits of entropy.

Format

sr_live_3f9c1d7e08b64a25c1e0a7d4f6b93e28d5c40a1b8e73f602d9a45c8e1b027f3a
└──┬───┘└───────────────────── 64 hex characters ──────────────────────┘
 prefix

From then on the dashboard only shows sr_live_ and the first 8 characters: enough to recognise a key in a list, nowhere near enough to rebuild it. We only store its SHA-256 hash, so even we cannot give it back to you.

Use the key

cURL

curl -X POST https://subreply.io/api/v1/scrape \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sr_live_VOTRE_CLE_API" \
  -d '{"subreddits": ["r/entrepreneur"], "keywords": ["leads"]}'

In Node.js or in an HTTP Request node (n8n, Make), it is the same header:

Node.js

const response = await fetch("https://subreply.io/api/v1/scrape", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${process.env.SUBREPLY_API_KEY}`,
  },
  body: JSON.stringify({
    subreddits: ["r/entrepreneur"],
    keywords: ["leads"],
  }),
});

const data = await response.json();

Security

Never client-side. A key in browser JavaScript, a mobile app or a public repository is a compromised key: anyone can then burn your credits and post under your account.
Always in an environment variable (SUBREPLY_API_KEY), or in your automation tool's credential manager. Not hardcoded and not in a URL — URLs end up in logs.
One key per use. A compromised n8n workflow can then be revoked without breaking your scripts.
When in doubt, revoke. Revocation is immediate and a new key takes two clicks. A lost key is not recovered, it is replaced.

The key gives access to your credits

It can generate and publish, so it can spend. Treat it like a means of payment, not like a username.

Authentication errors

Code	Meaning	Cause	Fix
`401`	Unauthorized	Header missing or malformed, key unknown or revoked.	Check the `Authorization: Bearer sr_live_…` header, with no stray space or line break.
`402`	Payment Required	The key is valid but the credit balance is empty or too low for the requested action.	Top up at subreply.io/billing.

Checks run in two steps: the key first (401), the balance second (402). So a 402 is always proof that your key itself is fine.