Authentication
All requests use your FetchLayer API key as a Bearer token. The same key works on every platform.
Sending requests
bash
curl -X POST https://api.fetchlayer.dev/web-unblocker/fetch \
-H "Authorization: Bearer ss-your-key" \
-H "Content-Type: application/json" \
-d '{"url":"https://news.ycombinator.com/","output":"markdown"}'Keep your key secret
Only use API keys in server-side code and rotate a key immediately if it is exposed.
What you may point it at
Public http and https addresses only. Reserved address space is refused before a request is made — loopback, private ranges, link-local and cloud metadata, IPv4-mapped, NAT64 and 6to4 spellings, and integer forms such as http://2852039166/. Ports are allowlisted to 80, 443, 8080 and 8443. Credentials before the hostname are rejected. Every redirect hop is re-validated against the same rules as the first, so a public address cannot redirect into a private one. Our own infrastructure is denied by name.
Authentication errors
A missing or invalid key returns HTTP 401. A key scoped to other platforms returns HTTP 403.
json
{
"error": "Invalid API key"
}