Troubleshooting

Common Scan API failures and how to fix them.

`X-API-KEY MISSING` / `INVALID`

Check the header name is exactly X-API-KEY.
Copy the key from the dashboard again. Deleted keys fail immediately.
Confirm you are calling the API origin (api.trythreatless.com or your self-hosted API), not the Nuxt app.

`Either 'file' or 'url' must be provided`

The multipart body is empty. Use -F "file=@…" or -F "url=…" with curl, or FormData in the browser. A JSON body is not accepted.

`File size exceeds limit: 10MB`

Split the payload or scan a smaller artifact. URL downloads honor the same cap via Content-Length and streamed bytes.

`Access to private/local addresses is forbidden`

The URL resolved to a private or loopback address. Use a public HTTPS URL, or upload the file instead.

`429 Rate limit exceeded`

Wait until X-RateLimit-Reset, or upgrade. Remaining quota is shared across every key on the account.

Scan hangs or `Error during scan process`

ClamAV (clamd) is down or unreachable. On self-hosted Docker, the API image starts clamd beside the JVM. Check container logs for freshclam / clamd errors and that nothing else is bound to port 3310.

Email confirmation / Google

Email users must confirm before login (Please confirm your email before logging in.).
Google-only accounts cannot use password login (Please sign in with Google).
If Google is disabled, the web app hides the button (NUXT_PUBLIC_GOOGLE_OAUTH_ENABLED).

CORS

The API only allows origins listed in CLIENT_ALLOWED_ORIGINS. A local Nuxt dev server must be in that list (http://localhost:3000 by default).

Language examples

Scan a file with cURL, JavaScript, TypeScript, Python, Go, PHP, Ruby, and Java.