SerpApi

Fronts the search endpoint of SerpApi; the gateway fills in the secret api_key parameter on the query string.

GET /serpapi   → https://serpapi.com/search?api_key=<secret>&<your query>

Only GET is mounted — no POST for search appears in SerpApi’s docs. The query string carries every control and goes upstream verbatim: engine (which SerpApi itself defaults to google), q, output (json by default; html returns the raw page), location, and the rest. Beyond the key, the gateway adds no parameter and defaults no value — the call lands on SerpApi exactly as if made directly.

Credential handling

• api_key is placed first in the query string.
• An api_key supplied by the client in the query is discarded (any encoding), so nothing can displace the injected key.
• Authorization is removed before the request goes upstream; SerpApi does nothing with your gateway token.

Examples

$
curl "$GATEWAY/serpapi?engine=google&q=coffee" \
>
  -H "Authorization: Bearer $TOKEN"

SerpApi’s JSON comes back untouched — or HTML, under output=html. Per-engine parameters are listed in SerpApi’s documentation.