NoPhishy Authentication: API Access & Security (2026)

Authentication overview

NoPhishy provides authentication mechanisms designed to secure both programmatic API access and direct user interface (UI) interaction. The platform's authentication protocols aim to protect sensitive data related to phishing simulation campaigns, security awareness training, and email threat detection. Developers integrating with NoPhishy's API typically rely on API keys, while administrators and end-users accessing the web interface authenticate using traditional username and password combinations, often reinforced with multi-factor authentication (MFA).

The choice of authentication method depends on the interaction context: API keys are suitable for server-to-server communication and automated tasks, whereas UI authentication secures administrative access and manual operations. Adherence to security best practices, such as proper credential management and regular rotation, is recommended across all authentication types to maintain the integrity of security operations. The NoPhishy platform is designed with GDPR compliance in mind, extending to its authentication processes to protect user data.

Supported authentication methods

NoPhishy supports distinct authentication methods tailored for different access scenarios.

API Key Authentication

For programmatic access, NoPhishy uses API keys. An API key is a unique token that identifies an application or user making requests to the API. It is typically included in the request headers or as a query parameter. API keys provide a straightforward method for authentication but require careful management to prevent unauthorized access. NoPhishy's developer documentation specifies how to generate and use these keys.

Username and Password Authentication

For direct access to the NoPhishy web-based administration panel, users authenticate using a username and password. This method is standard for web applications and secures access to the UI for managing campaigns, viewing reports, and configuring settings. NoPhishy encourages the use of strong, unique passwords and provides mechanisms for password resets and account recovery.

Multi-Factor Authentication (MFA)

NoPhishy supports multi-factor authentication (MFA) as an additional layer of security for UI access. MFA requires users to provide two or more verification factors to gain access to an account. This typically combines something the user knows (password), something the user has (a mobile device or hardware token), or something the user is (biometric data). Enabling MFA significantly reduces the risk of unauthorized access even if a password is compromised. FIDO Alliance standards provide a framework for strong authentication, which MFA implementations often align with.

Getting your credentials

Accessing NoPhishy's features, whether through the API or the web UI, requires specific credentials. The process for obtaining these credentials is managed within the NoPhishy platform.

API Key Generation

To generate an API key for programmatic access:

1. Log in to your NoPhishy administrator account via the web interface.
2. Navigate to the 'Settings' or 'API Management' section.
3. Locate the option to 'Generate New API Key' or similar.
4. Follow the on-screen prompts to create a new key. You may be asked to provide a descriptive name for the key to help with management.
5. Once generated, the API key will be displayed. It is crucial to copy and store this key securely immediately, as it may not be retrievable again for security reasons.
6. NoPhishy documentation provides guidance on managing API key permissions and scopes, allowing you to limit a key's capabilities to only what is necessary for its intended use.

User Account Setup

For username and password credentials:

1. New user accounts are typically created by an existing administrator within your organization's NoPhishy instance.
2. The administrator will assign a unique username (often an email address) and set an initial password, or send an invitation that prompts the user to set their password.
3. Upon first login, users may be prompted to change their password and/or set up multi-factor authentication.
4. Regular password changes are recommended, and users should choose strong, unique passwords that are not reused across other services. The Microsoft password guidance offers best practices for creating secure passwords.

Authenticated request example

When making API requests to NoPhishy, the API key is typically included in the HTTP headers. Below is an illustrative example of an authenticated request using curl, a common command-line tool for making HTTP requests. This example assumes you are making a GET request to a hypothetical endpoint for retrieving phishing campaign data.

curl -X GET \
  'https://api.nophishy.co.uk/v1/campaigns' \
  -H 'Authorization: Bearer YOUR_NOPHISHY_API_KEY' \
  -H 'Content-Type: application/json'

In this example:

• -X GET specifies the HTTP method.
• 'https://api.nophishy.co.uk/v1/campaigns' is the target API endpoint.
• -H 'Authorization: Bearer YOUR_NOPHISHY_API_KEY' is the critical header for authentication. Replace YOUR_NOPHISHY_API_KEY with your actual API key. The Bearer scheme is a common convention for sending API tokens, as defined in RFC 6750 for OAuth 2.0 Bearer Token Usage.
• -H 'Content-Type: application/json' indicates the expected format of the request or response body.

Always refer to the specific NoPhishy API documentation for exact endpoint paths, required parameters, and expected response formats, as they may vary depending on the API version and specific functionality.

Security best practices

Securing your NoPhishy account and integrations requires adherence to established security best practices for credential management and access control.

API Key Management

• Keep API Keys Confidential: Never hardcode API keys directly into client-side code, commit them to public version control systems, or expose them in public-facing applications. Store them in secure environment variables or a dedicated secret management service.
• Least Privilege: When generating API keys, assign only the minimum necessary permissions or scopes required for the task. This limits the potential damage if a key is compromised.
• Regular Rotation: Periodically rotate your API keys. This practice minimizes the window of opportunity for a compromised key to be exploited. NoPhishy's dashboard should provide functionality for generating new keys and revoking old ones.
• Monitor Usage: Regularly review API key usage logs and audit trails within the NoPhishy platform to detect any unusual activity or potential misuse.
• Secure Storage: Store API keys in secure, encrypted storage. For server-side applications, consider using a secrets manager like AWS Secrets Manager or Azure Key Vault.

User Account Security

• Strong, Unique Passwords: Enforce and use strong, unique passwords for all user accounts. Passwords should be long, complex, and not reused across multiple services. Password managers can aid in this.
• Enable Multi-Factor Authentication (MFA): Always enable MFA for user accounts, especially for administrative roles. MFA adds a critical layer of defense against credential theft.
• Principle of Least Privilege: Grant users only the permissions required to perform their job functions. Regularly review and adjust user roles and permissions as responsibilities change.
• Regular Audits: Conduct periodic audits of user accounts, checking for inactive accounts, unauthorized access, or suspicious login patterns.
• Session Management: Ensure that the NoPhishy platform enforces secure session management, including appropriate session timeouts and secure cookie handling. Users should log out when finished with their session.
• Employee Training: Educate users about phishing, social engineering, and the importance of strong security practices, reinforcing the core mission of NoPhishy itself.

General Security Practices

• Secure Development Lifecycle (SDL): For developers integrating with NoPhishy APIs, incorporate security considerations throughout the entire development lifecycle, from design to deployment.
• Network Security: Ensure that the network environment from which NoPhishy is accessed or integrated is secure, employing firewalls, intrusion detection systems, and secure network configurations.
• Stay Updated: Keep all systems, libraries, and frameworks used for integration up to date to patch known vulnerabilities.
• Incident Response Plan: Have a defined incident response plan in place for handling potential security breaches, including compromised credentials.