Authentication

All API requests are authenticated with a Bearer token passed in the Authorization header. This is the one and only authentication scheme - there is no X-API-Key header.

Creating an API key

1. Go to Dashboard > API Keys
2. Click Create Key
3. Copy the key immediately - it is only shown once

Keys have a tp_ prefix. The key is stored only as a SHA-256 hash - TurboPentest never keeps the raw value, so a lost key cannot be recovered and must be replaced.

Using your key

Include the key as a Bearer token in every request:

curl -H "Authorization: Bearer tp_your_key_here" \
  https://turbopentest.com/api/pentests

Error responses

All errors return JSON:

{
  "error": "Description of the error"
}

Rate limits

The API is rate-limited to protect service quality. If you receive a 429 response, wait before retrying. Contact support if you need higher limits.