Every Pro API v2 endpoint requires an API key. The Public API needs no
authentication.
Getting an API key
You can obtain your personal API key in your
account settings on leakcheck.io. Keys are at least
40 characters long.
Passing the key
There are two ways to authenticate a request:
- Header (recommended) — send the key in the
X-API-Key header:
- Query parameter — pass it as
?key=:
Prefer the header: query strings tend to end up in access logs, proxies and
browser history, so ?key= is best kept for quick tests and environments
where setting headers is inconvenient.
Keep the key out of your source code — read it from an environment variable
(the official Python wrapper picks up LEAKCHECK_APIKEY automatically).
Requests without the header are rejected with 401 Missing X-API-Key, and
requests with a wrong key with 400 Invalid X-API-Key — see
Errors for the full list.