What authentication methods does PhishStats support?

PhishStats exclusively uses API key authentication for all API access. There are no other methods like OAuth 2.0 or basic authentication supported.

How do I get my PhishStats API key?

You obtain your API key by registering or logging into your account on the PhishStats website and navigating to the API section or user dashboard, where you can generate or retrieve your key.

Where should I include my API key in requests?

Your API key should be included as a query parameter named `api_key` in the URL of your API requests to PhishStats.

Is it safe to hardcode my API key in my application?

No, it is not safe. API keys should be stored securely using environment variables or a secret management service, especially for server-side applications, to prevent exposure.

What happens if my API key is compromised?

If your API key is compromised, unauthorized parties could access your PhishStats entitlements. You should immediately regenerate your API key from your PhishStats account dashboard to invalidate the old one.

Does PhishStats support HTTPS for API calls?

Yes, PhishStats requires and enforces HTTPS for all API communications to ensure the secure transmission of your API key and data.

PhishStats Authentication: API Key Access (2026)

Authentication overview

PhishStats provides access to its real-time phishing threat intelligence through a RESTful API. Authentication for all API endpoints relies on a unique API key assigned to each user upon registration. This API key serves as the primary credential for verifying requests and controlling access to data feeds such as phishing URLs, IPs, and domains. The system uses the API key to identify the requesting application or user and enforce associated rate limits and subscription tiers PhishStats API documentation.

The API key mechanism is a common authentication pattern for web services, especially those that provide data and require control over consumption based on user entitlements AWS API key explanation. It offers a straightforward way to manage access without requiring complex token exchange flows. PhishStats's implementation requires the API key to be included with every API request, typically as a query parameter or within a custom HTTP header.

Supported authentication methods

PhishStats exclusively supports API key authentication. This method involves generating a secret key from your account dashboard and including it in your API requests.

The table below summarizes the characteristics of API key authentication as implemented by PhishStats:

Method	When to Use	Security Level
API Key (single global key per account)	All API calls to PhishStats endpoints	Moderate (relies on secure key management by the user)

There are no alternative authentication methods such as OAuth 2.0, JWT tokens, or basic authentication directly supported by the PhishStats API for client applications. The simplicity of API key usage is balanced by the user's responsibility to manage and protect their key securely.

Getting your credentials

To obtain your PhishStats API key, follow these steps:

Register or Log In: Visit the PhishStats website and either register for a new account or log in to an existing one. Registration typically requires an email address and password.
Access API Section: After logging in, navigate to the API section or your user dashboard. The specific path might vary but usually includes a link like 'API' or 'Developers' or 'My Account'.
Generate/Retrieve API Key: Within the API section, you should find an option to generate or view your API key. For new accounts, a key might be automatically generated upon first access to this section. Existing users will see their current key.
Copy Your API Key: Securely copy the displayed API key. This key is a long alphanumeric string and is essential for all API interactions.

PhishStats provides a dedicated API documentation page that outlines the exact steps and provides more context on where to find your unique key after account creation. If you lose or compromise your API key, most dashboards offer an option to regenerate it, invalidating the old key immediately.

Authenticated request example

Once you have your API key, you can include it in your API requests. PhishStats typically expects the API key to be passed as a query parameter named api_key. Below is an example using curl to query the PhishStats API for phishing data.

Assume your API key is YOUR_SECRET_API_KEY_HERE and you want to fetch recent phishing URLs.


curl "https://phishstats.com:8080/api/v2/phishing?api_key=YOUR_SECRET_API_KEY_HERE"

Replace YOUR_SECRET_API_KEY_HERE with your actual API key obtained from your PhishStats account. The response will be in JSON format, containing the requested phishing intelligence data. For specific endpoint details and available parameters, refer to the PhishStats API reference.

When integrating with other programming languages, the approach remains consistent:

Python: Use the requests library and pass the API key in the params dictionary.
JavaScript (Node.js/Browser): Use fetch or axios and append the API key to the URL.
PHP: Use curl or file_get_contents with the API key in the URL.

Always ensure that the API key is not hardcoded directly into client-side code that could be publicly accessible or committed to version control systems without proper exclusion.

Security best practices

Protecting your PhishStats API key is critical to maintaining the security of your applications and preventing unauthorized access to your account and data. Here are key security best practices:

Treat API Keys as Sensitive Credentials: Your API key grants access to your PhishStats account data. Treat it with the same level of security as a password or private cryptographic key Google Cloud API key best practices. Do not embed it directly in publicly accessible client-side code or commit it to public version control repositories.
Environment Variables or Secret Management: For server-side applications, store your API key in environment variables, a dedicated secret management service (e.g., AWS Secrets Manager, Google Secret Manager), or a secure configuration file that is not checked into version control. This prevents the key from being exposed if your code repository is compromised.
Restrict Access to API Key: Limit who has access to the API key within your organization. Only individuals or systems that absolutely require it for operational purposes should have access.
HTTPS-Only Communication: Always ensure that all communication with the PhishStats API occurs over HTTPS. The example request provided uses https://phishstats.com:8080, indicating secure transport. This encrypts your API key and data in transit, preventing eavesdropping and man-in-the-middle attacks. PhishStats enforces HTTPS for all API interactions PhishStats API reference.
Regular Key Rotation (if supported): While PhishStats does not explicitly detail an automated key rotation policy, it is a general security best practice. Periodically regenerating your API key from your PhishStats dashboard helps mitigate the risk of a compromised key remaining valid indefinitely. Invalidate old keys immediately after generating new ones.
Monitor API Usage: Keep an eye on your API usage statistics available in your PhishStats account. Unusual spikes or patterns in requests could indicate that your API key has been compromised and is being used without your authorization.
Error Handling for Authentication Failures: Implement robust error handling in your application to gracefully manage authentication failures (e.g., due to an invalid or expired API key). This can help detect issues quickly and prevent your application from consuming further resources unnecessarily.