FullHunt Authentication: API Keys & Secure Access (2026)

Authentication overview

FullHunt provides an External Attack Surface Management (EASM) platform designed for continuous asset discovery and vulnerability monitoring. Programmatic access to the FullHunt platform, including its asset discovery and vulnerability intelligence capabilities, is secured primarily through API keys. These keys serve as the primary mechanism for authenticating requests made to the FullHunt API, allowing users to integrate FullHunt's features into their existing security workflows, scripts, and applications.

The FullHunt API is built to enable automated interactions, such as initiating scans, retrieving asset data, and managing discovered vulnerabilities. All API requests must be authenticated to ensure that only authorized users and systems can access and manipulate data within their FullHunt account. The API leverages standard web protocols, with API keys passed securely in request headers over HTTPS to protect credentials during transit.

Understanding the authentication process is foundational for any integration with FullHunt. This page details the supported authentication methods, guides on obtaining and managing credentials, provides an example of an authenticated request, and outlines security best practices to protect your API keys and maintain the integrity of your security operations.

Supported authentication methods

FullHunt's API primarily utilizes API keys for authenticating requests. This method is common for web APIs due to its simplicity and effectiveness when properly managed. API keys function as a secret token that identifies and authenticates the user or application making the request.

API Keys

API keys are unique, alphanumeric strings generated within the FullHunt user dashboard. When included in an API request, they verify the identity of the requester, granting access to the resources and data associated with that FullHunt account. API keys are typically passed in the Authorization header of HTTP requests, following the Bearer scheme.

This method is suitable for server-to-server communication, command-line tools, and backend applications where the API key can be securely stored and managed. It provides a direct and efficient way to authenticate requests without requiring complex multi-step authentication flows like OAuth 2.0, which is generally more suited for user delegation scenarios rather than direct application access. For more information on API key security, refer to the Google Maps API key security recommendations.

Table: FullHunt Authentication Methods

Getting your credentials

To interact with the FullHunt API, you will need to generate an API key from your FullHunt account dashboard. The process generally involves logging into your account and navigating to a designated API settings or profile section.

1. Log In to FullHunt: Access your FullHunt account through the official FullHunt homepage. If you do not have an account, you can sign up for a Free Community Account to get started.
2. Navigate to API Settings: Once logged in, locate the section related to API access or developer settings. This is typically found under your user profile, account settings, or a dedicated 'API Keys' menu item. Consult the FullHunt documentation for the exact navigation path, as UI elements may evolve.
3. Generate a New API Key: Within the API settings, you should find an option to generate a new API key. It is a best practice to generate separate keys for different applications or environments (e.g., development, staging, production) to facilitate key rotation and revocation without impacting all integrations.
4. Copy and Securely Store Your Key: After generation, the API key will be displayed. It is crucial to copy this key immediately and store it securely. For security reasons, FullHunt typically only displays the key once, and it cannot be retrieved again if lost. Treat your API key with the same level of confidentiality as you would a password.

When generating an API key, consider associating it with specific permissions or roles if FullHunt offers such granularity. This adheres to the principle of least privilege, ensuring that an exposed key can only access the minimum necessary resources.

Authenticated request example

Once you have obtained your API key, you can use it to authenticate requests to the FullHunt API. The API key should be included in the Authorization header of your HTTP requests, using the Bearer scheme. This is a common and secure method for transmitting API keys.

Here's an example of how to make an authenticated request using curl to fetch all recognized assets:

curl -X GET \
  'https://fullhunt.io/api/v1/assets' \
  -H 'Authorization: Bearer YOUR_FULLHUNT_API_KEY' \
  -H 'Content-Type: application/json'

In this example:

• -X GET specifies the HTTP method (GET).
• 'https://fullhunt.io/api/v1/assets' is the API endpoint you are targeting. You can find a comprehensive list of available endpoints in the FullHunt API reference.
• -H 'Authorization: Bearer YOUR_FULLHUNT_API_KEY' is the crucial line for authentication. Replace YOUR_FULLHUNT_API_KEY with the actual API key you generated from your FullHunt dashboard. The Bearer prefix is standard for token-based authentication.
• -H 'Content-Type: application/json' indicates that the request body (if any) is JSON. While not strictly necessary for a GET request without a body, it's good practice to include for API consistency.

When integrating with programming languages, the method of adding the Authorization header will vary by language and HTTP client library. For instance, in Python using the requests library, it might look like this:

import requests
import os

api_key = os.getenv('FULLHUNT_API_KEY') # Securely retrieve from environment variable
headers = {
    'Authorization': f'Bearer {api_key}',
    'Content-Type': 'application/json'
}

response = requests.get('https://fullhunt.io/api/v1/assets', headers=headers)

if response.status_code == 200:
    print(response.json())
else:
    print(f"Error: {response.status_code} - {response.text}")

This Python example demonstrates retrieving the API key from an environment variable, which is a recommended security practice for handling sensitive credentials. Further details on API usage are available in the FullHunt API reference documentation.

Security best practices

Securing your FullHunt API keys is paramount to protect your account and data from unauthorized access. Adhering to these best practices helps mitigate common risks associated with API key management:

• Treat API Keys as Passwords: Your API key grants access to your FullHunt account. Never embed it directly in client-side code, public repositories, or commit it to version control systems. Treat it with the same level of confidentiality as your login credentials.
• Use Environment Variables for Storage: Store API keys in environment variables rather than hardcoding them into your application's source code. This prevents accidental exposure and allows for easier rotation without code changes. For cloud deployments, leverage secret management services like AWS Secrets Manager or Google Cloud Secret Manager, or Azure Key Vault, which provide secure storage and access control for sensitive data. AWS Secrets Manager documentation provides details on this approach.
• Restrict IP Access: If FullHunt supports it, configure your API keys to only accept requests from a specific set of trusted IP addresses. This adds an extra layer of security, preventing unauthorized access even if a key is compromised.
• Implement Least Privilege: If FullHunt allows for granular permissions on API keys, generate keys with only the minimum necessary permissions required for the task at hand. This limits the damage an attacker can inflict if a key is compromised.
• Regularly Rotate API Keys: Periodically rotate your API keys, ideally every 90 days or more frequently, especially after major system changes or personnel departures. This reduces the window of opportunity for a compromised key to be exploited. FullHunt's dashboard typically offers functionality to revoke old keys and generate new ones.
• Monitor API Key Usage: Keep an eye on your API access logs for unusual activity, such as a sudden spike in requests, requests from unexpected geographical locations, or attempts to access unauthorized resources. This can help detect potential compromises early.
• Use HTTPS Exclusively: Always ensure that all API requests are made over HTTPS. This encrypts the communication channel, protecting your API key and data from eavesdropping during transit. FullHunt's API mandates HTTPS for all interactions.
• Secure Development Practices: Follow secure coding guidelines throughout your development lifecycle. Implement proper input validation and error handling to prevent common web vulnerabilities that could lead to API key exposure.

By implementing these security measures, you can significantly reduce the risk of unauthorized access to your FullHunt account and maintain a strong security posture for your integrations.