Your Unwrangle auth token (API key) grants access to your account’s credits and data extraction capabilities. Treat it with the same care as a password.
Important note on multiple keys
Unwrangle currently supports one API key per account.
We do not offer the ability to create multiple keys under a single account. If you need separate keys (for example for different environments or teams), you will need to create separate accounts
Best practices
Never hard-code the key
Do not put the token directly in your source code, notebooks, or shared configuration files.
Keep it out of version control
Add .env (and any other files that contain secrets) to your .gitignore. Never commit keys to GitHub, GitLab, or similar repositories — even private ones can be exposed.
Store the key securely
Use environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler, or your hosting platform’s built-in secrets store). Load the key at runtime.
Prefer the Authorization header
When possible, authenticate with:
Authorization: Token
Passing the key as a query parameter (&api_key=...) increases the chance it will appear in server logs, proxy logs, or browser history.
Keep the key server-side only
Never expose it in client-side JavaScript, mobile apps, or any code that runs in a user’s browser.
Rotate the key if it is ever exposed
If the key appears in a log, repository, screenshot, or anywhere it shouldn’t, regenerate it immediately from the console:
Open the Account tab from the navbar menu
Scroll to the bottom
Click Rotate API key
Copy the new token and update every integration right away
The old key is revoked the moment the new one is issued and will return 401 Unauthorized. Your credits, plan, and usage history remain unchanged.
💡 Tip: If you suspect a key has leaked, rotate first, then investigate. There is no other recovery for a compromised key.