# Get a key

> Sign in, make a key and keep it safe. Scrape keys and account keys.

**TL;DR**: sign in with Google or GitHub at `https://app.megalania.io/login`. Open
the **Keys** page and make a key. Send it as
`Authorization: Bearer meg_sk_…`. Nobody at Megalania has to do anything
for you.

Two addresses appear below. `https://get.megalania.io` is the host for
scraping. `https://api.megalania.io` is the host for batches, keys and your
account.

## From nothing to a 200 in five steps

**1. Sign in.** Open `https://app.megalania.io/login` and press **Sign in
with Google** or **Sign in with GitHub**. Your first sign-in makes your
account. In the beta, only invited emails can sign in. If the sign-in page
says you are not invited, write to support@megalania.io from the email you
want to use.

**2. Make a key.** Open the **Keys** page. Pick a name, the scope and the
date it stops working, then press **Create**:

- scope **scrape** (`meg_sk_…`): for scraping and batches.
- scope **account** (`meg_ak_…`): for your account over the API: more
  keys, people, usage, purchases. It cannot scrape.

Every key has an end date, at most 400 days ahead. **We show each key
once.** Store it in a password manager now.

**3. Put it in your shell.**

```sh
export MEG_API_KEY='meg_sk_...'
```

**4. Use it now.** A new key works within a second, at most a minute.

**5. Scrape.**

```sh
curl -s -o /dev/null -w '%{http_code}\n' \
  -H "Authorization: Bearer $MEG_API_KEY" \
  "https://get.megalania.io/v1?engine=http&url=https://docs.megalania.io/start/quickstart"
```

It prints `200`. This key is the bearer key that the other guides call
"your key". A key in the address (`?api_key=`) is refused.

## Subscribing and buying credits

:::note[Soon]
Payments are not open yet. During the beta, your credits come as a grant,
and the plan and pack pages show prices only.
:::

Sign in, then pick a plan. You pay on Stripe's page; we never see your card.
Each paid month adds the plan's monthly credits to your account as soon as
Stripe confirms the payment. Credits from a month last 61 days, so unused
ones carry over one month. A pack tops up an active subscription and is
sold only for your plan. If you open `/buy` signed out, the page sends you
to sign in and back.

In test mode, use the card `4242 4242 4242 4242`, any future date and any
CVC. No real money moves.

Over the API, the account's owner subscribes with an account key:
`POST /v1/account/subscription`. See [account.md](/guides/account#subscribe).
Packs: `POST /v1/account/checkout`, see [account.md](/guides/account#top-up).

## A lost key

Make a new one on the **Keys** page and revoke the old one there. A revoked
key stops working within about a second. There is nothing to recover: we
store only a hash of each key.

## Errors on this page

| HTTP | `error.code` | what to do |
| -- | -- | -- |
| 401 | `bad_token` | The key is wrong, revoked or past its end date, or it is not in the `Authorization` header. Make a new key. |
| 403 | `wrong_scope` | An account key (`meg_ak_…`) cannot scrape. Use a scrape key (`meg_sk_…`). |

Every code, with its cost, is in [errors.md](/reference/errors).