Authentication
BreachSpider supports two authentication methods depending on your use case.
API Key Authentication (Recommended for Integrations)
Include your API key as a Bearer token in the Authorization header.
curl -H "Authorization: Bearer bs_live_your_key_here" \
"https://breachspider.com/api/v1/cves"
API keys:
- Require Professional tier or above
- Are prefixed with
bs_live_for easy identification in code and logs - Are stored as SHA-256 hashes - the raw key is shown only once at generation
- Can be scoped to
read,write, oralertspermissions - Can be set to expire after 30, 90, or 365 days, or never
Generate keys at Integrations > API Keys in the dashboard.
Each API key is scoped to your organization's monthly API-call allowance (25,000 calls/month on Professional; unlimited on Enterprise). Current usage is returned on every API-key response via the X-RateLimit-Limit, X-RateLimit-Used, and X-RateLimit-Remaining headers, and in the billing status endpoint.
!!! tip "Building an integration?"
Development API access with raised limits is available on request for teams
integrating BreachSpider into their own platform or product. This is a
non-commercial, conversation-first channel for design partners and custom
integrations — not a self-serve plan. Email
[[email protected]](mailto:[email protected]) with a short
description of what you are building.
Session Authentication (Web App)
The web application uses magic-link email authentication with httponly session cookies. No passwords are stored or transmitted.
Tier Requirements
| Feature | Free | Standard | Professional | Enterprise |
|---|---|---|---|---|
| API key generation | - | - | Yes | Yes |
Max results per page (per_page) | 10 | 100 | 100 | 100 |
| Monthly API-call allowance | - | - | 25,000 | Unlimited |
| Webhook delivery | - | Yes | Yes | Yes |
| SAGE full analysis | - | - | Yes | Yes |
The per_page maximum is 100 on all paid tiers (10 on Free). There is no pagination depth cap on paid tiers, so you can retrieve the full result set by paging through it. Request rate is governed by fair use rather than a published per-minute quota. See Rate Limits.
Security Notes
- All API traffic is encrypted via TLS 1.2+ through Cloudflare
- API keys are never logged in plain text
- Include your key in headers only - never in query strings or URLs
- Rotate compromised keys immediately at Integrations > API Keys > Revoke