API & Tools

Authentication X-API-KEY and credentials

REST calls to https://api.ismalicious.com accept X-API-KEY (Base64 of apiKey:apiSecret) or HTTP Basic Auth (username=apiKey, password=apiSecret). HTTPS is required.

Get API Key API Reference

No credit card required · Free API key

X-API-KEY

Header

Basic

or user:pass

HTTPS

Required

Session

Or cookie*

Capabilities

Key features. Everything you need to protect your infrastructure and users.

X-API-KEY header

Single header; value = Base64(apiKey:apiSecret).

Dashboard keys

Copy apiKey and apiSecret from Account settings.

Server-side only

Never expose credentials in frontend or mobile apps.

Session option

Logged-in browser requests may use session cookie.

Rate limits

Burst and quota headers on check/CVE routes.

OpenAPI

Security scheme documented at api.ismalicious.com/openapi.json.

Applications

Use cases. How security teams use this tool.

cURL

-H "X-API-KEY: $(echo -n key:secret | base64)"

Python

base64.b64encode(f"{k}:{s}".encode()).decode()

Node

Buffer.from(`${k}:${s}`).toString("base64")

SDKs

Pass apiKey + apiSecret; clients build the header.

X-API-KEY and Basic Auth

Production base URL is https://api.ismalicious.com. Set X-API-KEY to Base64(apiKey:apiSecret), or send HTTP Basic Auth with username=apiKey and password=apiSecret (curl -u). Legacy TAXII clients may still use any username and the Base64 credential as the password.

Session cookie (dashboard)

When you are logged into ismalicious.com, the same API routes accept your Auth.js session cookie. External apps and scripts should always use X-API-KEY.

Key management

Store credentials in environment variables or a secrets manager. Do not commit keys to git. Use separate keys per environment where possible.

Errors

Missing header: 401 with message about empty x-api-key. Invalid pair: 401 Invalid API key. Rate limit: 429 with X-RateLimit-* (per-minute burst) or X-Monthly-* (monthly quota) headers, and Retry-After.

Support

Frequently asked questions.

How do I authenticate API requests?

X-API-KEY: <base64(apiKey:apiSecret)>, or HTTP Basic with username=apiKey and password=apiSecret. Get both from your dashboard.

How do I get an API key?

Sign up and open Account → API keys to view or rotate credentials. No account yet? One curl to /api/keys/instant returns a free key pair (see below).

Can I get a key without creating an account first?

Yes. One request mints a free key pair: curl -d "email=you@example.com" https://ismalicious.com/api/keys/instant. The response includes the ready X-API-KEY header, the free quota (50 checks/month, 60/min) and an example call; the address receives a link to claim the account, set a password and rotate the pair. Limited to 3 keys per day per IP. The MCP server's bootstrap_key tool uses the same path.

Why Base64?

The API verifies the pair in one header; encoding key:secret keeps the delimiter unambiguous.

What should I do if my key is compromised?

Rotate keys in the dashboard and redeploy integrations immediately.

Explore

Related tools.

Rate Limits

Usage limits

SDKs

Client libraries

API Playground

Try the API

Research

Related articles. Learn more from our security research blog.

Blog post

API Integration for Threat Intelligence: Automate Your Security

Discover how integrating threat intelligence APIs can transform your security infrastructure. Learn best practices for automated threat detection, continuous monitoring, and documented integration with your existing systems.

Blog post

Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real Volume

One incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.

Blog post

STIX/TAXII Threat Feeds: Operational Guide for OpenCTI, MISP, and SIEM Pipelines

How to wire STIX 2.1 and TAXII 2.1 collections into OpenCTI, MISP, or your SIEM — what to poll, how to handle confidence and aging indicators, and where enrichment APIs fit alongside feed ingestion.

Get Started

Ready to get started?

Join thousands of security teams using isMalicious to protect their infrastructure.

Create free account Contact Sales

No credit card required · Free API key