Web of Trust Authentication: API Key Setup & Security (2026)

Authentication overview

Web of Trust (WOT) provides reputation data for websites and domains, primarily through its browser extensions and a dedicated API. For programmatic access to WOT's threat intelligence, authentication is a prerequisite to ensure that only authorized applications can query its services and retrieve reputation scores and categories. The authentication mechanism for the WOT API is designed for simplicity and direct integration, relying on a single credential type.

The core purpose of WOT authentication is to manage access to its proprietary database of website evaluations. This allows developers to integrate WOT's insights into custom applications, security tools, or content filtering systems. By authenticating requests, WOT can monitor usage, enforce rate limits, and ensure service integrity. The chosen method aligns with common practices for external API access, balancing ease of use with necessary security considerations.

While the WOT browser extension offers a free tier for individual users, access to the WOT API for programmatic integration typically involves a commercial arrangement, which includes the provision of necessary authentication credentials. This tiered approach ensures that different user segments have appropriate access levels to WOT's services.

Supported authentication methods

Web of Trust primarily supports API keys for authenticating requests to its API. This method is a common approach for web services that need to identify the calling application and enforce access policies without requiring complex user-level authentication flows.

An API key is a unique string of characters that an application includes with its requests to the WOT API. The API key serves as both an identifier and a secret token. When the WOT API receives a request, it checks the provided API key against its records to confirm the legitimacy of the request and the authorization of the caller to access the requested data. This mechanism is straightforward to implement and manage for server-to-server communication or applications where the API key can be securely stored.

Authentication Method Table

Other authentication methods, such as OAuth 2.0, are not typically specified for direct API access to WOT's reputation data. OAuth 2.0 is more commonly used for delegated authorization, where a third-party application needs access to a user's resources on another service without obtaining their credentials directly, as detailed in the OAuth 2.0 specification. For the WOT API's specific use case of providing reputation data, a simpler API key model is generally sufficient and preferred for its operational efficiency.

Getting your credentials

To obtain an API key for the Web of Trust API, developers typically need to engage directly with WOT's sales or support team. The process for acquiring API access and the corresponding credentials is not self-service through a public developer portal for the API, unlike the browser extension which has a free tier and paid premium tier.

1. Contact WOT Sales: The primary step is to visit the Web of Trust homepage and navigate to the API section or contact their sales department. The official website indicates that API pricing requires sales contact.
2. Discuss Requirements: You will likely need to discuss your specific use case, expected query volume, and integration needs with the WOT team. This helps them determine the appropriate API plan and terms of service.
3. Agreement and Provisioning: Once terms are agreed upon, WOT will provision your API access. This typically includes generating a unique API key that is then provided to you. This key is your credential for making authenticated requests to the WOT API.
4. Secure Storage: Upon receiving your API key, it is crucial to store it securely. API keys grant access to the service and should be treated with the same level of confidentiality as other sensitive credentials.
5. Integration Instructions: WOT will provide specific documentation or instructions on how to include your API key in your requests. This usually involves passing the key as a query parameter or an HTTP header.

It is important to note that the API key is tied to your specific commercial agreement and usage policies. Any misuse or unauthorized sharing of the key could lead to service interruption or termination of your access. Always refer to the official WOT documentation provided at the time of your API key issuance for the most accurate and up-to-date instructions.

Authenticated request example

When making an authenticated request to the Web of Trust API, your API key will be included as part of the request. While specific endpoint details and parameter names are found in the official WOT API documentation (obtained after sales contact), a common pattern for API key authentication is to pass the key as a query parameter in the URL. Below is a conceptual example demonstrating this pattern using a placeholder API key and URL.

Conceptual API Request with API Key

GET https://api.mywot.com/v2/public/getreputation?hosts=example.com/&key=YOUR_API_KEY_HERE HTTP/1.1
Host: api.mywot.com
User-Agent: YourApplication/1.0

In this example:

• https://api.mywot.com/v2/public/getreputation is a hypothetical endpoint for retrieving reputation data.
• hosts=example.com/ is a query parameter specifying the URL or domain for which reputation is requested.
• key=YOUR_API_KEY_HERE is the critical authentication parameter where YOUR_API_KEY_HERE must be replaced with your actual, securely obtained WOT API key.

Expected Response (Conceptual JSON)

Upon a successful authenticated request, the WOT API would typically return a JSON response containing the reputation scores and categories for the queried host. The structure of this response would be detailed in the API documentation.

{
  "example.com/": {
    "0": [
      0,
      0,
      ""  
    ],
    "target": "example.com",
    "last_update": "1678886400",
    "categories": {
      "101": 0, 
      "102": 0  
    },
    "safety": [
      90, 
      5  
    ]
  }
}

This conceptual JSON response illustrates how reputation data, including safety scores and categorized trust levels, might be structured. The exact keys and values would be defined by the WOT API specification at the time of integration.

Security best practices

Securing your Web of Trust API key is paramount to maintaining the integrity of your application and preventing unauthorized access to WOT's services. Adhering to established security practices for API keys is essential.

1. Do Not Embed API Keys Directly in Client-Side Code: Never hardcode your WOT API key directly into public client-side code (e.g., JavaScript in a web browser, mobile application binaries). This makes the key easily discoverable and exploitable. All API requests involving your key should originate from a secure backend server.
2. Use Environment Variables or Secret Management Services: Store your API key in environment variables on your server or utilize a dedicated secret management service (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault). This separates sensitive credentials from your codebase and allows for easier rotation and management. Learn more about API key best practices from Google Cloud.
3. Implement HTTPS for All API Communications: Ensure that all communication with the WOT API uses HTTPS. This encrypts the data in transit, protecting your API key and the reputation data from interception by malicious actors. Most modern API clients and libraries default to HTTPS.
4. Restrict API Key Permissions (if applicable): While WOT API keys typically provide access to reputation data, if there were ever options to restrict API key permissions (e.g., read-only vs. write access), always apply the principle of least privilege. Grant only the minimum necessary permissions for your application's functionality.
5. Monitor API Key Usage: Regularly review your API usage logs, if available, to detect any unusual activity that might indicate a compromised key. High volumes of unexpected requests or requests from unfamiliar IP addresses could signal a breach.
6. Implement IP Whitelisting (if supported): If the WOT API offers IP whitelisting, configure your API key to only accept requests from a predefined list of trusted IP addresses belonging to your servers. This significantly reduces the risk of unauthorized use even if the key is compromised.
7. Rotate API Keys Periodically: Establish a routine for rotating your API keys. Regularly generating new keys and deprecating old ones minimizes the window of opportunity for a compromised key to be exploited.
8. Secure Your Build and Deployment Pipelines: Ensure that your CI/CD pipelines handle API keys securely, preventing their exposure in logs, version control systems, or temporary build artifacts.

By diligently applying these security best practices, you can significantly mitigate the risks associated with using API keys for Web of Trust authentication and protect your integration from potential vulnerabilities.