API Keys

Create, use, and revoke API keys for the Scan API.

API keys let any client call POST /api/v1/scans without a browser session. Manage them from API Key in the dashboard.

Creating a key

Open API Key in the sidebar.
Give the key a name you will recognize later (for example ci-production).
Create it and copy the value.

The key is a 32-character hex string (a UUID without dashes). Send it on every public API request:

terminal

curl -X POST https://api.trythreatless.com/api/v1/scans \
  -H "X-API-KEY: YOUR_API_KEY" \
  -F "file=@./suspect.bin"

How keys are used

The X-API-KEY header is required on /api/**.
A missing header returns 401 with { "error": "X-API-KEY MISSING" }.
An unknown key returns 401 with { "error": "X-API-KEY INVALID" }.
A valid key is resolved to your user, then the hourly quota is consumed.

Keys are listed on the dashboard with their name, value, creation date, and last use. Last use updates after a successful scan.

Anyone with a key can scan files as you and consume your plan quota. Do not commit keys to git. Rotate a leaked key by deleting it and creating a new one.

Revoking a key

Delete the key from the dashboard. The next request that uses it is rejected as invalid. There is no delay and no remaining grace period.

Dashboard vs API keys

Client	Auth	Endpoint
Your app, CI, scripts	`X-API-KEY`	`POST /api/v1/scans`
Signed-in scanner UI	Session JWT	`POST /web/scans`

Both paths share the same engine, size limit, and hourly quota. See Authentication.

Dashboard

Monitor scan volume, infection rate, and recent results from one control center.