# Global APIs & your own key

Besides the native scrapers, Apizie includes more than a thousand global APIs (payments, messaging, developer tools, media, open data and more). They are imported from public OpenAPI specs in the [APIs.guru OpenAPI Directory](https://github.com/APIs-guru/openapi-directory) and called through the same `/v1` pattern, envelope, quotas and MCP tools.

## Two kinds of global API

| Badge | Meaning |
| Live | The provider needs no key. Call it with just your Apizie key. |
| Your key | The provider needs credentials. Bring your own key (BYOK). |

## Sending your provider key

Add one of these headers next to your Apizie key. Apizie places it where the provider expects (header, query or basic auth) and forwards the call.

| `x-upstream-key` | The raw key or token. For basic auth send `username:password`. |
| `x-upstream-authorization` | A full `Authorization` header value, sent as is. |

bashCopy
```
curl "https://zieapi.vercel.app/v1/finance:stripe/get-balance" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $STRIPE_SECRET_KEY"
```

Your provider key is used for that request only. It is never stored, logged or shown in the dashboard, and responses fetched with it are cached per account and per key so they are never served to anyone else.

Without a key, a BYOK endpoint answers `401` with `error.code = "upstream_key_required"` and tells you where the key goes. That request is not billed as a success.

## Server-side keys (self-hosting)

Operators can set a shared key per API with an env var named `APIZIE_UPSTREAM_KEY_` plus the API key in upper case, for example `APIZIE_UPSTREAM_KEY_FINANCE_STRIPE`. A caller's own header always wins. Check each provider's terms before sharing a key with your users.

## Via MCP
`run_scraper` accepts an optional `upstream_key` argument. `get_scraper_schema` returns the auth type.

## Refreshing the directory
bashCopy
```
npm i --no-save openapi-directory
node scripts/import-openapi.js node_modules/openapi-directory/api
```