HeaderSec API docs

Create a key

Sign in on the dashboard, create a named API key, and copy the token immediately. HeaderSec only shows the full token once.

export HEADERSEC_API_KEY="hsec_live_your_key_here"

Authenticate requests

Send the key as a bearer token. The API also accepts the same token in the x-headersec-api-key header.

Authorization: Bearer $HEADERSEC_API_KEY

Run a scan

Authenticated scans are associated with your team and appear in your dashboard history.

curl -sS -X POST https://api.headersec.com/api/v1/scans \
  -H "authorization: Bearer $HEADERSEC_API_KEY" \
  -H "content-type: application/json" \
  --data '{"url":"https://example.com","force":true}'

Read history

Use the history endpoint to fetch recent authenticated scans for your team.

curl -sS https://api.headersec.com/api/v1/history \
  -H "authorization: Bearer $HEADERSEC_API_KEY"

Manage keys

Owners and admins can list, create, and revoke team API keys from the dashboard or API. Create a replacement key before revoking an old one.

curl -sS https://api.headersec.com/api/v1/api-keys \
  -H "authorization: Bearer $HEADERSEC_API_KEY"

Key safety

• Do not commit API keys to source control.
• Store keys in CI secrets or local environment variables.
• Name keys after where they are used, such as GitHub Actions or Production scanner.
• Revoke keys you no longer use or believe may have leaked.

Understand the findings

Read the HTTP security headers guide for practical baselines, deployment cautions, and validation steps for the controls returned by a scan.