Authentication - Pentest-Tools.com documentation

Overview

The API uses Bearer token authentication. Include your API key in the Authorization header of every request.

API access is included in every paid plan. If you receive a 403 “Your plan does not have API access” error, check your subscription.

Getting your API key

Access your Pentest-Tools.com account.

Go to API settings

Navigate to My account > API.

Create a key

Click Create API Key, give it a name, and optionally set an expiration date.

Copy and store

Copy your key immediately. It won’t be shown again.

Using the API key

Include the key in the Authorization header with the Bearer prefix:

Authorization: Bearer YOUR_API_KEY

Example request

import requests

API_KEY = "YOUR_API_KEY"
API_URL = "https://api.pentest-tools.com/api/v2"

response = requests.get(
    f"{API_URL}/targets",
    headers={"Authorization": f"Bearer {API_KEY}"}
)

print(response.json())

Keys and data regions

The base URL is the same whichever data region your account is in. Each key carries a prefix identifying its region, and requests are routed on that prefix, so there is nothing region-specific to configure and no separate hostname to call.

API key security

Treat your API key like a password. Never commit it to version control or expose it in client-side code.

Best practices

Practice	Description
Environment Variables	Store keys in environment variables, not in code
Rotation	Rotate keys periodically
Expiration	Set expiration dates on keys
Naming	Use descriptive names to identify key purpose
Monitoring	Check “Last used” date in My account > API

Managing keys

From My account > API you can:

Create multiple keys for different purposes (CI/CD, scripts, integrations)
View when each key was last used
Set expiration dates (1-365 days, or never)
Revoke compromised keys immediately

Authentication errors

Code	Message	Solution
401	Unauthorized	API key is missing or invalid
403	Your plan does not have API access	Upgrade to a plan with API access
403	Forbidden	Valid key but insufficient permissions for the action

⌘I

​Overview

​Getting your API key

​Using the API key

​Example request

​Keys and data regions

​API key security

​Best practices

​Managing keys

​Authentication errors

​Related topics

Overview

Getting your API key

Using the API key

Example request

Keys and data regions

API key security

Best practices

Managing keys

Authentication errors

Related topics