Build with Zapi, end to end.

Getting started

Tiga langkah dari nol ke first request:

1. Daftar / login di /login — gratis, tanpa kartu kredit.
2. Generate API key di Dashboard → API Keys. Salin sekali — full key tidak bisa di-recover.
3. Pilih endpoint dari /apis dan kirim request pertama.

# Pertama: bikin akun di https://zpi.web.id/login
# Salin API key dari dashboard, lalu:
curl -H "x-api-key: zpi_xxx" \
  "https://api.zpi.web.id/api/scrape/instagram/profile?username=zaadevofc"

Authentication

Semua request authenticated pakai header x-api-key. Jangan pernah commit key ke repo — pakai env var dan rotasi periodik dari dashboard.

• Key format: prefix "zpi_" + 32 random chars.
• Full key di-reveal hanya sekali saat create. Setelah itu display-nya masked (zpi_••••5f4a).
• Revoke key kapan pun dari dashboard — efek instan, tanpa grace period.

// Authentication via header (recommended)
const res = await fetch(
  "https://api.zpi.web.id/api/scrape/tiktok/user?username=tiktok",
  {
    headers: { "x-api-key": process.env.ZAPI_KEY },
  }
);
const json = await res.json();
console.log(json.content);

Error codes

Semua error mengikuti envelope yang sama: { status, message, errors }. HTTP status code matches the envelope status.

{
  "status": 429,
  "message": "Rate limit exceeded",
  "errors": [
    {
      "code": "RATE_LIMITED",
      "detail": "60 requests/minute reached. Retry after 12s."
    }
  ]
}

Rate limits

Rate limit per-plan, di-enforce di edge. Tiap response menyertakan header info — pakai itu daripada sleep statis.

• Free: 60 req/min, 2.000 req/bulan. Pro & Ultra: lihat Pricing.
• Pas dapat 429, respect Retry-After — jangan hammer.
• Untuk burst load, prefer exponential backoff (base 500ms, cap 30s).

# Response headers untuk tiap request
X-RateLimit-Limit:     60
X-RateLimit-Remaining: 47
X-RateLimit-Reset:     1717286400   # epoch seconds
Retry-After:           12            # only on 429

Webhooks

Subscribe ke event (request success/failure, key rotation, dst) via Dashboard → Webhooks. Tiap delivery di-sign HMAC-SHA256 dengan secret per-webhook.

• Header x-zapi-signature berisi hex digest atas raw body.
• Verify sebelum proses — drop request dengan signature mismatch tanpa logging body (untuk security).
• Idempotency key di header x-zapi-event-id — dedupe di sisi receiver.

// Verifikasi signature webhook
import crypto from "node:crypto";

function verify(rawBody, signatureHeader, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expected)
  );
}