2xx range indicate success. Codes in the 4xx range indicate an issue with the request (bad parameters, blocked by the target site, etc.). Codes in the 5xx range indicate either an upstream issue at the target site or, rarely, a problem on our side.
Status codes
401 unauthorized
A401 means the request was rejected at our edge, before it ever reached the scraping engine. Because nothing was scraped, a 401 does not count against your quota and is never billed.
Unlike validation errors, 401 responses have a plain-text body (Content-Type: text/plain), not JSON. There are two distinct messages, and they mean different things:
Unauthorized
x-scrapeunblocker-key header does not match any known key. Common causes:
- A typo, or a truncated copy-paste. Keys are long; make sure the whole value was copied.
- Trailing whitespace or a newline in the header value - especially when the key is read from a file rather than an environment variable.
- An empty header value. Sending
x-scrapeunblocker-keywith nothing after it counts as an unknown key, not as a missing header. - A rotated or revoked key. After you generate a new key in the dashboard, the old one stops working once its short grace period ends.
- Environment mismatch. Production keys only work against
api.scrapeunblocker.com. A key issued for one environment sent to another is an unknown key there.
No valid subscription
A billing problem on an active subscription returns
402, not 401 - quota exceeded, credit limit exceeded, or a card that failed repeatedly. 401 is strictly about who you are, 402 about what you owe.Missing header returns 400, not 401
If you omit the x-scrapeunblocker-key header entirely, the response is 400 Bad Request with the body Missing x-scrapeunblocker-key. This is deliberate: it separates “you forgot to authenticate” from “you authenticated, and it was rejected”, so client code can tell a wiring bug from a credential problem.
402 payment required
A402 means your key and account are recognised and in good standing as credentials - the request was stopped for a billing reason. Like 401, it is refused at our edge before anything is scraped, so a 402 consumes no quota and is never billed.
The body is plain text (Content-Type: text/plain), not JSON. There are three messages:
If more than one applies, the most serious wins: payment failure outranks credit limit, which outranks quota.
All three clear themselves. Our load balancer refreshes key statuses about once a minute, so once you upgrade or the invoice is paid, access comes back within roughly a minute - no key change, no support ticket, no redeploy.
Quota exceeded
402 you can see coming.
Credit limit exceeded
Payment failed - update payment method
402 versus its neighbours
422 validation error shape
When you send an invalid request body,/getPageSource, /serpApi, and /getImage all return a structured validation error:
loc is the path to the problem field. msg is human-readable. type is a stable machine-readable identifier.
403 - blocked vs. invalid key
A403 from ScrapeUnblocker never means your API key is wrong. Invalid keys return 401. A 403 always means: the target site blocked us on every bypass route we tried.
When you see 403:
- Try a different
proxy_country. Some sites geo-fence or geo-rotate their bot protection. A US site may be unreachable from EU IPs and vice versa. - Wait and retry. Rate-based blocks expire after a few minutes.
- Contact support if the same URL repeatedly fails - we may need to add a custom plugin for that domain.
Retries and idempotency
All three endpoints are safe to retry. Requests are idempotent in the sense that retrying with the same parameters does not double-charge or create duplicate state on your account. We recommend exponential backoff for transient5xx errors:

