Authentication
X-API-KEY and credentials
All traffic intelligence REST calls to https://api.ismalicious.com use the X-API-KEY header with Base64(apiKey:apiSecret). HTTPS is required.
X-API-KEY
Header
Base0
key:secret
HTTPS
Required
Session
Or cookie*
Key Features
Everything you need to protect your infrastructure and users
X-API-KEY header
Single header; value = Base64(apiKey:apiSecret).
Dashboard keys
Copy apiKey and apiSecret from Account settings.
Server-side only
Never expose credentials in frontend or mobile apps.
Session option
Logged-in browser requests may use session cookie.
Rate limits
Burst and quota headers on check/CVE routes.
OpenAPI
Security scheme documented at api.ismalicious.com/openapi.json.
Use Cases
How security teams use this tool
cURL
-H "X-API-KEY: $(echo -n key:secret | base64)"
Python
base64.b64encode(f"{k}:{s}".encode()).decode()
Node
Buffer.from(`${k}:${s}`).toString("base64")
SDKs
Pass apiKey + apiSecret; clients build the header.
X-API-KEY format
Production base URL is https://api.ismalicious.com. For every protected route, set header X-API-KEY to the Base64 encoding of your apiKey, a colon, and your apiSecret (UTF-8). Example: Python credentials = base64.b64encode(f"{api_key}:{api_secret}".encode()).decode(); requests.get(url, headers={"X-API-KEY": credentials}).
Session cookie (dashboard)
When you are logged into ismalicious.com, the same API routes accept your Auth.js session cookie. External apps and scripts should always use X-API-KEY.
Key management
Store credentials in environment variables or a secrets manager. Do not commit keys to git. Use separate keys per environment where possible.
Errors
Missing header: 401 with message about empty x-api-key. Invalid pair: 401 Invalid API key. Rate limit: 429 with X-RateLimit-* headers.
Frequently Asked Questions
How do I authenticate API requests?
How do I get an API key?
Why Base64?
What should I do if my key is compromised?
Related Tools
Related Articles
Learn more from our security research blog
Ready to Get Started?
Join thousands of security teams using isMalicious to protect their infrastructure.