Authentication X-API-KEY and credentials
REST calls to https://api.ismalicious.com accept X-API-KEY (Base64 of apiKey:apiSecret) or HTTP Basic Auth (username=apiKey, password=apiSecret). HTTPS is required.
No credit card required · Free API key
X-API-KEY
Header
Basic
or user:pass
HTTPS
Required
Session
Or cookie*
Key features. Everything you need to protect your infrastructure and users.
X-API-KEY header
Single header; value = Base64(apiKey:apiSecret).
Dashboard keys
Copy apiKey and apiSecret from Account settings.
Server-side only
Never expose credentials in frontend or mobile apps.
Session option
Logged-in browser requests may use session cookie.
Rate limits
Burst and quota headers on check/CVE routes.
OpenAPI
Security scheme documented at api.ismalicious.com/openapi.json.
Use cases. How security teams use this tool.
cURL
-H "X-API-KEY: $(echo -n key:secret | base64)"
Python
base64.b64encode(f"{k}:{s}".encode()).decode()
Node
Buffer.from(`${k}:${s}`).toString("base64")
SDKs
Pass apiKey + apiSecret; clients build the header.
X-API-KEY and Basic Auth
Production base URL is https://api.ismalicious.com. Set X-API-KEY to Base64(apiKey:apiSecret), or send HTTP Basic Auth with username=apiKey and password=apiSecret (curl -u). Legacy TAXII clients may still use any username and the Base64 credential as the password.
Session cookie (dashboard)
When you are logged into ismalicious.com, the same API routes accept your Auth.js session cookie. External apps and scripts should always use X-API-KEY.
Key management
Store credentials in environment variables or a secrets manager. Do not commit keys to git. Use separate keys per environment where possible.
Errors
Missing header: 401 with message about empty x-api-key. Invalid pair: 401 Invalid API key. Rate limit: 429 with X-RateLimit-* headers.
Frequently asked questions.
How do I authenticate API requests?
How do I get an API key?
Why Base64?
What should I do if my key is compromised?
Related tools.
Related articles. Learn more from our security research blog.
Ready to get started?
Join thousands of security teams using isMalicious to protect their infrastructure.
No credit card required · Free API key