API Keys Setup Guide

Step-by-step instructions for configuring each integration.

Facebook App ID & App Secret

Required for the Facebook Sharing Debugger module.

1

Open the Facebook Developers Portal. Go to developers.facebook.com and sign in with your Facebook account.

2

Create a new app. Click "My Apps" → "Create App". Select the "Business" app type. Enter a name (e.g., CacheWarmer) and create the app.

3

Copy the App ID. After creation, you'll be redirected to the dashboard. The App ID is displayed at the top of the page.

4

Copy the App Secret. Navigate to Settings → Basic. Click "Show" next to "App Secret" and confirm with your password. Copy the value.

5

Configure in CacheWarmer. Enter the App ID and App Secret in your CacheWarmer settings. The access token is automatically composed as app_id|app_secret.

config.yaml
facebook:
  enabled: true
  appId: "123456789012345"
  appSecret: "abc123def456ghi789jkl012mno345pq"
  rateLimitPerSecond: 10
The app does not need to be published — the scrape endpoint works with an App Access Token. Rate limit: max 200 calls/hour per app.

LinkedIn Session / OAuth

Required for the LinkedIn Post Inspector module.

1

Understand the options. LinkedIn offers two approaches: the Marketing API (OAuth 2.0 flow) for production use, or a session-based approach for personal/development use.

2

Option A: LinkedIn Marketing API. Register an app at linkedin.com/developers, configure OAuth 2.0, and obtain an access token through the authorization flow.

3

Option B: Session-based approach. For personal use, you can extract the li_at session cookie from your browser's developer tools while logged into LinkedIn.

4

Set the environment variable.

Environment
LINKEDIN_SESSION_COOKIE=your_li_at_cookie_value
LinkedIn session cookies expire periodically. Monitor for authentication failures and refresh the cookie when needed. LinkedIn also has strict rate limits — CacheWarmer handles this automatically with configurable delays.

IndexNow Key

Required for the IndexNow protocol module (Bing, Yandex, Seznam, Naver).

1

Generate a key. Create a 32-character hexadecimal key:

Bash
openssl rand -hex 16

Example output: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

2

Host the key file. Create a text file at your web root with the key as both the filename and content:

Text
# The file should be accessible at:
# https://yourdomain.com/a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6.txt
#
# The file content should be the key itself:
a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
3

Set the environment variable.

Environment
INDEXNOW_KEY=a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
IndexNow is supported by Bing, Yandex, Seznam, and Naver. Google does not participate in IndexNow — use the Google Search Console API module instead.

Google Search Console Service Account

Required for the Google Search Console API module.

1

Create a Google Cloud project. Go to console.cloud.google.com and create a new project (or select an existing one).

2

Enable the Search Console API. In the API Library, search for "Google Search Console API" and enable it for your project.

3

Create a service account. Go to IAM & Admin > Service Accounts > Create Service Account. Download the JSON key file.

4

Add to Search Console. Copy the service account email (e.g., [email protected]) and add it as a user in Google Search Console with "Full" access for your property.

5

Set the environment variable. Point to the JSON key file:

Environment
GOOGLE_SERVICE_ACCOUNT_JSON=./config/google-service-account.json
Google imposes a daily quota of 200 URL inspections per property. CacheWarmer manages this automatically, prioritizing new and recently updated URLs.

Bing Webmaster Tools API Key

Required for the Bing Webmaster Tools API module.

1

Sign in to Bing Webmaster Tools. Go to bing.com/webmasters and sign in with your Microsoft account.

2

Verify your site. Add and verify ownership of your website if you haven't already.

3

Get your API key. Navigate to Settings > API Access > API Key. Copy the generated key.

4

Set the environment variable.

Environment
BING_API_KEY=your_bing_api_key_here

Cloudflare API Token Enterprise

Required for the Cloudflare Cache Purge module.

1

Open the Cloudflare Dashboard. Go to dash.cloudflare.com and select your domain.

2

Copy the Zone ID. On your domain overview page, find the Zone ID in the right sidebar under "API" (a 32-character hex string).

3

Create an API Token. Go to My Profile → API Tokens → "Create Token". Choose "Custom Token" with permissions: Zone → Cache Purge → Purge. Restrict to your specific zone.

4

Configure in CacheWarmer.

config.yaml
cloudflare:
  enabled: true
  apiToken: "YOUR_CLOUDFLARE_API_TOKEN"
  zoneId: "YOUR_ZONE_ID"
The token only needs Cache Purge permission — no other rights required. Cloudflare allows up to 30 URLs per purge request.

Imperva API Credentials Enterprise

Required for the Imperva Cache Purge module.

1

Open the Imperva Console. Go to my.imperva.com and sign in.

2

Get your API ID and API Key. Go to Account Settings → API Keys. If no key exists, click "Add API Key". Copy both the API ID (numeric) and API Key (alphanumeric).

3

Find your Site ID. Go to Websites → select your site. The Site ID is a numeric value found in the URL or under Settings → General.

4

Configure in CacheWarmer.

config.yaml
imperva:
  enabled: true
  apiId: "YOUR_IMPERVA_API_ID"
  apiKey: "YOUR_IMPERVA_API_KEY"
  siteId: "YOUR_SITE_ID"
Imperva uses api_id + api_key in the request body for authentication. Purge propagation is typically under 500ms across the Imperva network.

Akamai EdgeGrid Credentials Enterprise

Required for the Akamai Fast Purge module.

1

Open Akamai Control Center. Go to control.akamai.com and sign in.

2

Create an API Client. Go to Identity & Access → API Clients → "Create API Client". Select the CCU APIs (Content Control Utility) with READ-WRITE access.

3

Copy all four credentials. After creation, immediately copy the Host, Client Token, Client Secret, and Access Token. These are only shown once.

4

Configure in CacheWarmer.

config.yaml
akamai:
  enabled: true
  host: "akaa-xxxxx.luna.akamaiapis.net"
  clientToken: "akab-xxxxx"
  clientSecret: "xxxxx="
  accessToken: "akab-xxxxx"
  network: "production"
Akamai uses EdgeGrid (EG1-HMAC-SHA256) authentication — CacheWarmer handles this internally. Up to 50 URLs per invalidation request. Use network: "staging" for testing.

API Keys Configured? Start Warming.

Check the documentation for installation and deployment.