Several SAM.gov scrapers begin with the same instruction: register at api.sam.gov, wait for approval, paste your key here. It sounds like diligence. It is the tool handing you its hardest operational problem.
Two public routes, one of them keyed
GSA publishes an official opportunities API. It is real, documented, and it requires a registered key with a quota. That is the right choice for some integrations and this article is not an argument against it existing.
There is also the endpoint the SAM.gov search page itself calls when a member of the public searches for contracts. It needs no credential, because the search page needs none. That is what this Actor reads.
What requiring a key actually costs you
Three things, in the order you meet them:
- An approval wait before the first run. You cannot evaluate the tool today.
- A quota you own. The ceiling is on your key, not on the tool.
- A renewal you will forget. Keys expire, and the pipeline fails when it does.
The quota problem is transferred, not solved
This is the part worth being precise about. A keyed tool has not removed the rate limit — it has moved the limit onto an account you administer, so that when it binds, the failure arrives as your misconfiguration.
Why this data is public in the first place
Because publication is the point. FAR Part 5 requires agencies to publicise contract actions precisely so that businesses can find them, and U.S. Government works are not subject to copyright under 17 U.S.C. § 105.
That is unusual and worth appreciating: most of what this site documents is public in the weak sense of “visible if you look”. Federal notices are public in the strong sense of “published because a rule says they must be” — what that settles and what it does not.
When the official API is the right choice
If you need a supported contract with a versioning policy and someone to escalate to, use the keyed API. That is what it is for, and a public endpoint carries none of those guarantees.
The honest summary of the trade: the keyed API gives you a contract and a quota; the public endpoint gives you no contract and no credential to manage. This Actor takes the second, and says so rather than implying there is no first.
Reading a public endpoint responsibly
No credential is not a licence to hammer it. The Actor keeps to 4 concurrent requests with a one-second delay, fetches robots.txt on every single run, and enforces it in the request layer so a disallowed path is never requested.
SAM.gov is public infrastructure paid for by taxpayers. Treating a rate limit's absence as permission to consume it is the behaviour that gets public endpoints closed.
