Authenticated Scraping (BYOS)

Prerequisites

Member Pricing

Amazon Prime, Walmart+, Costco, Tesco Clubcard — see the real prices that logged-in members pay, not the inflated public price.

Paywalled Content

News sites, research portals, and SaaS dashboards that gate content behind a subscription or login wall.

Private Communities

Reddit private subreddits, Discord public servers, Discourse forums that require authentication to view threads.

Personalized Data

Order history, account dashboards, saved lists, and other content that only appears for the logged-in user.

Step 1: Open the target site and log in

Navigate to the site (e.g. amazon.com) and sign in with your account.

Step 2: Open DevTools → Application → Cookies

Press F12 or Ctrl+Shift+I, click the Application tab, expand Cookies in the left panel, and select the target domain.

Step 3: Copy the session cookies

Identify the cookies that maintain your login. Common names include:

• session-id, session-token (Amazon)
• reddit_session (Reddit)
• JSESSIONID, PHPSESSID (common patterns)
• __Secure-next-auth.session-token (NextAuth sites)

Step 4: Create a session in AlterLab

curl-X POST https://api.alterlab.io/api/v1/sessions \-H"X-API-Key: YOUR_API_KEY"\-H"Content-Type: application/json"\-d'{
 "name": "My Amazon Prime",
 "domain": "amazon.com",
 "cookies": {
 "session-id": "144-1234567-8901234",
 "session-token": "abc123xyz789..."
 }
 }'

Step 5: Scrape with your session

curl-X POST https://api.alterlab.io/api/v1/scrape \-H"X-API-Key: YOUR_API_KEY"\-H"Content-Type: application/json"\-d'{
 "url": "https://www.amazon.com/dp/B0EXAMPLE",
 "session_id": "SESSION_ID_FROM_STEP_4"
 }'

Health Monitoring

AlterLab tracks consecutive failures and success rates. Sessions are automatically marked as expired or invalid when cookies stop working.

Validation

The POST /sessions/:id/validate endpoint makes a real request to the target domain and checks for logged-in indicators, returning a confidence score.

Cookie Rotation

When cookies expire, use POST /sessions/:id/refresh to replace them. This resets failure counters and re-activates the session.

# Kill all sessions for your accountcurl-X DELETE https://api.alterlab.io/api/v1/sessions \-H"Authorization: Bearer your_jwt_token"
# Response{"deleted":12,
"message":"All sessions deactivated"}

How it works

1. Fetch AlterLab's public key via GET /sessions/public-key
2. Encrypt your cookies client-side using the public key
3. Send the encrypted payload when creating or refreshing a session
4. AlterLab decrypts only at scrape time, in an ephemeral worker — the plaintext is never stored

Export all session data associated with your account in machine-readable format (JSON). Use this to fulfill data access requests under GDPR Article 15.

curl https://api.alterlab.io/api/v1/sessions/privacy/export \-H"Authorization: Bearer your_jwt_token"\-o sessions-export.json

Permanently and irreversibly delete all session data, including encrypted cookie values, usage logs, and audit trails. This fulfills erasure requests under GDPR Article 17 (Right to be Forgotten).

curl-X DELETE https://api.alterlab.io/api/v1/sessions/privacy/purge \-H"Authorization: Bearer your_jwt_token"\-H"Content-Type: application/json"\-d'{"confirm": "PURGE_ALL_SESSION_DATA"}'
# Response{"purged_sessions":12,
"purged_audit_records":847,
"completed_at":"2025-01-15T12:00:00Z"}

View and configure the data retention policy for session data. You can set automatic purge schedules to align with your organization's data handling policy.

curl https://api.alterlab.io/api/v1/sessions/privacy/retention \-H"Authorization: Bearer your_jwt_token"
# Response{"retention_days":90,
"auto_purge_expired": true,
"purge_on_account_deletion":true}

Rotate cookies regularly

Most session cookies expire after hours or days. Set up a schedule to refresh cookies before they expire. Use the expires_at field when creating sessions so AlterLab can warn you.

Use one session per domain

Sessions are domain-scoped. Create separate sessions for amazon.com and amazon.co.uk. Mixing domains is not supported.

Validate before heavy usage

Call POST /sessions/:id/validate after creating or refreshing a session. This catches expired or invalid cookies before you waste credits on failed scrapes.

Monitor session health

Check consecutive_failures and success_rate in the session details. If failures spike, refresh your cookies.

Scrape at a reasonable rate

Authenticated scraping with your personal account cookies should mimic normal browsing patterns. Aggressive scraping can trigger the target site's abuse detection and invalidate your session.

Use zero-knowledge mode for sensitive sites

For banking, healthcare, or any site where cookie exposure is a concern, enable client-side encryption so AlterLab never sees your plaintext credentials.