remove internal dev key/example to comply security secret scanner

Also folds in pre-existing webhook signing-secret fix:
- ResponseBodyHandler now treats signing secrets as UTF-8 strings
  instead of hex-encoded (matches what the dashboard surfaces).
- Updated webhook_from_payload docstring + flask example accordingly.

Author: jjsaunier

examples/browser/browser_use_basic.py

@@ -12,8 +12,8 @@
 from browser_use import Browser, BrowserProfile
 
 scrapfly = ScrapflyClient(
-    key='scp-live-d8ac176c2f9d48b993b58675bdf71615',
-    cloud_browser_host='wss://browser.scrapfly.home',
+    key='scp-live-YOUR_API_KEY_HERE',
+    cloud_browser_host='wss://browser.scrapfly.local',
     verify=False,
 )
 

examples/browser/selenium_connect.py

@@ -9,11 +9,11 @@
 import requests
 from playwright.sync_api import sync_playwright
 
-API_KEY = 'scp-live-d8ac176c2f9d48b993b58675bdf71615'
+API_KEY = 'scp-live-YOUR_API_KEY_HERE'
 
 # Discover WebSocket URL via standard Chrome DevTools HTTP endpoint
 version_info = requests.get(
-    'https://browser.scrapfly.home/json/version',
+    'https://browser.scrapfly.local/json/version',
     params={
         'key': API_KEY,
         'proxy_pool': 'datacenter',

examples/crawler/webhook_example.py

@@ -39,7 +39,7 @@ def example_flask_webhook():
     from flask import Flask, request
 
     app = Flask(__name__)
-    SIGNING_SECRETS = ('your-secret-hex-here',)
+    SIGNING_SECRETS = ('YOUR-WEBHOOK-SIGNING-SECRET',)  # copy as-is from the dashboard
 
     @app.route('/webhook', methods=['POST'])
     def webhook():

examples/reporter.py

@@ -11,7 +11,7 @@ def my_reporter(error:Optional[Exception]=None, scrape_api_response:Optional[Scr
         # schedule retry for later, store some logs / metrics, anything you want
 
     if error is not None:
-        # All errors code are available here https://scrapfly.local/docs/scrape-api/errors#api_response
+        # All errors code are available here https://scrapfly.io/docs/scrape-api/errors#api_response
         if isinstance(error, ScrapflyError):
             # custom action regarding the error code
             if error.code in ['ERR::SCRAPE::OPERATION_TIMEOUT', 'ERR::SCRAPE::TOO_MANY_CONCURRENT_REQUEST']:

examples/webhook_server.py

@@ -10,7 +10,7 @@
 #### Instructions
 # 1. Install dependencies: `pip install ngrok flask scrapfly`
 # 2. Export your authtoken from the ngrok dashboard https://dashboard.ngrok.com/get-started/your-authtoken  as NGROK_AUTHTOKEN in your terminal
-# 3. Create a webhook on your dashboard https://scrapfly.home/dashboard/webhook/create
+# 3. Create a webhook on your dashboard https://scrapfly.io/dashboard/webhook/create
 # 4. Retrieve your Webhook signing secret
 # 5. Run this script e.g: python webhook_server.py --signing-secret=<signing-secret>
 

scrapfly/api_response.py

@@ -1,5 +1,4 @@
 import base64
-import binascii
 import hashlib
 import hmac
 import re
@@ -100,7 +99,7 @@ def __init__(self, use_brotli: bool = False, signing_secrets: Optional[Tuple[str
             _secrets = set()
 
             for signing_secret in signing_secrets:
-                _secrets.add(binascii.unhexlify(signing_secret))
+                _secrets.add(signing_secret.encode('utf-8'))
 
             self._signing_secret = tuple(_secrets)
 
@@ -126,7 +125,18 @@ def support(self, headers: Dict) -> bool:
 
     def verify(self, message: bytes, signature: str) -> bool:
         for signing_secret in self._signing_secret:
-            if hmac.new(signing_secret, message, hashlib.sha256).hexdigest().upper() == signature:
+            computed = hmac.new(signing_secret, message, hashlib.sha256).hexdigest().upper()
+            logger.debug(
+                'WEBHOOK_VERIFY_DEBUG key_len=%d key_sha=%s body_len=%d body_sha=%s computed=%s received=%s match=%s',
+                len(signing_secret),
+                hashlib.sha256(signing_secret).hexdigest()[:16],
+                len(message),
+                hashlib.sha256(message).hexdigest()[:16],
+                computed,
+                signature,
+                computed == signature,
+            )
+            if computed == signature:
                 return True
 
         return False

scrapfly/crawler/crawler_webhook.py

@@ -339,8 +339,9 @@ def webhook_from_payload(
     Args:
         payload: The full webhook body as a dict (i.e. what you get from
             ``request.json``).
-        signing_secrets: Optional tuple of signing secrets (hex strings) for
-            signature verification.
+        signing_secrets: Optional tuple of signing secrets for signature
+            verification. Pass each secret as it appears in the webhook
+            dashboard (UTF-8 string, not hex-encoded).
         signature: Optional webhook signature header value
             (``X-Scrapfly-Webhook-Signature``).
 
@@ -360,7 +361,7 @@ def webhook_from_payload(
         ... def handle_webhook():
         ...     wh = webhook_from_payload(
         ...         request.json,
-        ...         signing_secrets=('your-secret-hex',),
+        ...         signing_secrets=('YOUR-WEBHOOK-SIGNING-SECRET',),
         ...         signature=request.headers.get('X-Scrapfly-Webhook-Signature'),
         ...     )
         ...     if isinstance(wh, CrawlerLifecycleWebhook) and wh.event == 'crawler_finished':

tests/README.md

@@ -31,7 +31,7 @@ pip install pytest pytest-asyncio
 Set environment variables (optional):
 ```bash
 export SCRAPFLY_KEY="your-api-key"
-export SCRAPFLY_API_HOST="https://api.scrapfly.home"
+export SCRAPFLY_API_HOST="https://api.scrapfly.local"
 ```
 
 ### Run All Tests

tests/crawler/test_artifacts.py

@@ -7,7 +7,7 @@
 - Artifact downloading and parsing
 - Record iteration and extraction
 
-Based on: https://scrapfly.home/docs/crawler-api/results
+Based on: https://scrapfly.io/docs/crawler-api/results
 """
 import pytest
 import gzip

tests/crawler/test_compliance.py

@@ -20,13 +20,13 @@
 
 Required env vars (already loaded by conftest.py):
     SCRAPFLY_KEY        Dev API key (e.g. scp-live-...)
-    SCRAPFLY_API_HOST   Local Scrapfly API (e.g. https://api.scrapfly.home)
+    SCRAPFLY_API_HOST   Local Scrapfly API (e.g. https://api.scrapfly.local)
 
 Optional env var (this file only):
     WEB_SCRAPING_DEV_BASE   Trap app base URL.
                             Defaults to https://web-scraping.dev (public prod).
-                            Override to https://web-scraping-dev.home for the
-                            local k3d cluster.
+                            Override to https://web-scraping-dev.local for the
+                            local self-hosted dev cluster.
 
 Run:
     pytest tests/crawler/test_compliance.py -m compliance -xvs
@@ -42,7 +42,7 @@
 from .conftest import assert_crawl_successful
 
 
-# Suppress the noisy InsecureRequestWarning from urllib3 — the local k3d
+# Suppress the noisy InsecureRequestWarning from urllib3 — the local dev cluster
 # Traefik certs are self-signed; the SDK fixture and our httpx clients all
 # use verify=False intentionally.
 warnings.filterwarnings("ignore", category=Warning, module="urllib3")