Authentication
X-API-KEY and credentials
All traffic intelligence REST calls to https://api.ismalicious.com use the X-API-KEY header with Base64(apiKey:apiSecret). HTTPS is required.
X-API-KEY
Header
Base0
key:secret
HTTPS
Required
Session
Or cookie*
Key Features
Everything you need to protect your infrastructure and users
X-API-KEY header
Single header; value = Base64(apiKey:apiSecret).
Dashboard keys
Copy apiKey and apiSecret from Account settings.
Server-side only
Never expose credentials in frontend or mobile apps.
Session option
Logged-in browser requests may use session cookie.
Rate limits
Burst and quota headers on check/CVE routes.
OpenAPI
Security scheme documented at api.ismalicious.com/openapi.json.
Use Cases
How security teams use this tool
cURL
-H "X-API-KEY: $(echo -n key:secret | base64)"
Python
base64.b64encode(f"{k}:{s}".encode()).decode()
Node
Buffer.from(`${k}:${s}`).toString("base64")
SDKs
Pass apiKey + apiSecret; clients build the header.
X-API-KEY format
Production base URL is https://api.ismalicious.com. For every protected route, set header X-API-KEY to the Base64 encoding of your apiKey, a colon, and your apiSecret (UTF-8). Example: Python credentials = base64.b64encode(f"{api_key}:{api_secret}".encode()).decode(); requests.get(url, headers={"X-API-KEY": credentials}).
Session cookie (dashboard)
When you are logged into ismalicious.com, the same API routes accept your Auth.js session cookie. External apps and scripts should always use X-API-KEY.
Key management
Store credentials in environment variables or a secrets manager. Do not commit keys to git. Use separate keys per environment where possible.
Errors
Missing header: 401 with message about empty x-api-key. Invalid pair: 401 Invalid API key. Rate limit: 429 with X-RateLimit-* headers.
Frequently Asked Questions
How do I authenticate API requests?
How do I get an API key?
Why Base64?
What should I do if my key is compromised?
Related Tools
Related Articles
Learn more from our security research blog
Ready to Get Started?
Rejoignez des milliers d'équipes de sécurité qui utilisent isMalicious pour protéger leur infrastructure.