Skip to main content
Every request to the SOC Defenders API must include a valid API key. You pass the key in an HTTP request header — either as a Bearer token in the Authorization header or directly in the X-API-Key header. Both methods are equivalent; use whichever fits your tooling or integration.

​
Getting an API key

To generate an API key, sign in to SOC Defenders and go to Settings → API Keys. Click Create key, give it a name, and copy the value — it is shown only once.
  • Free tier: create up to 3 API keys
  • Pro tier: create up to 50 API keys
All keys follow the format sk_live_....

​
Passing your key in a request

​
Authorization header (Bearer token)

​
X-API-Key header

Both headers are accepted on every endpoint. You do not need to use both at the same time.

​
Authentication errors

If your key is missing, malformed, or invalid, the API returns a 401 Unauthorized response with a JSON error body. Missing key

​
Error code reference

​
Security best practices

Never include your API key in a URL query parameter. Query strings appear in server logs, browser history, and referrer headers, which exposes your key to unintended parties. Always pass the key in a request header.
  • Store keys in environment variables or a secrets manager, not in source code.
  • Use one key per integration so you can rotate or revoke individual keys without disrupting others.
  • If a key is compromised, delete it immediately in Settings → API Keys and replace it with a new one.
  • On the Pro tier, take advantage of your 50-key limit to scope keys by team, environment, or service.