Dashboard keys
Copy apiKey and apiSecret from Account settings.
API & Tools
Authentication with your key pair
REST calls to https://api.ismalicious.com accept X-API-KEY (Base64 of apiKey:apiSecret) or HTTP Basic Auth (username=apiKey, password=apiSecret). HTTPS is required.
No credit card required · Free API key
Request
One header on every protected call.
# X-API-KEY = Base64(apiKey:apiSecret)
curl "https://api.ismalicious.com/check?query=example.com" \
-H "X-API-KEY: $(echo -n "$API_KEY:$API_SECRET" | base64)"
# Or HTTP Basic Auth
curl -u "$API_KEY:$API_SECRET" \
"https://api.ismalicious.com/check?query=example.com"Legacy TAXII clients can send any username with the Base64 credential as the password.
| Status | Meaning |
|---|---|
| 401 | Missing or invalid credentials |
| 403 | Your plan does not include this route |
| 429 | Rate limit exceeded; see the X-RateLimit-* headers |
Capabilities
Key features at a glance.
Server-side only
Keep keys in environment variables or a secrets manager, never in frontend code, mobile apps or git.
Session option
Logged-in browser requests can use the session cookie. Scripts use X-API-KEY.
FAQ
Frequently asked questions.
How do I authenticate API requests?
X-API-KEY: <base64(apiKey:apiSecret)>, or HTTP Basic with username=apiKey and password=apiSecret. Get both from your dashboard.
How do I get an API key?
Sign up and open Account → API keys to view or rotate credentials. No account yet? One curl to /api/keys/instant returns a free key pair (see below).
Can I get a key without creating an account first?
Yes. One request mints a free key pair: curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant. The response includes the ready X-API-KEY header, the free quota (250 requests/month, 60/min) and an example call; the address receives a link to claim the account, set a password and rotate the pair. Limited to 3 keys per day per IP. The MCP server's bootstrap_key tool uses the same path.
Why Base64?
The API verifies the pair in one header; encoding key:secret keeps the delimiter unambiguous.
What should I do if my key is compromised?
Rotate keys in the dashboard and redeploy integrations immediately.
Explore
Related tools and pages.
Research
Related articles from the research blog.
Blog post
API Integration for Threat Intelligence: Automate Your Security
Discover how integrating threat intelligence APIs can transform your security infrastructure. Learn best practices for automated threat detection, continuous monitoring, and documented integration with your existing systems.
Read more
Blog post
Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real Volume
One incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.
Read more
Blog post
STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines
How to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.
Read moreTest it with your own indicators.
The free plan includes website lookups with no monthly cap and 250 API requests a month. Check the sources and limits, then connect the API.
No credit card required · Free API key