---
title: "Quick Start"
description: "Run your first TurboPentest pentest in under five minutes, start to finish, using either the REST API or the dashboard's New Pentest flow."
canonical: https://turbopentest.com/docs/getting-started/quick-start
source: "TurboPentest Docs"
---

# Quick Start

This guide walks you through running your first pentest using the API. You can also start pentests from the [dashboard](https://turbopentest.com/pentests/new).

## Prerequisites

- A TurboPentest account ([sign up](https://turbopentest.com))
- A domain you own or are authorized to test
- At least one pentest credit

## Step 1: Create an API key

Go to **Dashboard > API Keys** and click **Create Key**. Give it a name and copy the key - you will only see it once.

```bash
# Save your API key
export TURBOPENTEST_API_KEY="tp_your_key_here"
```

## Step 2: Verify your domain

Add a DNS TXT record to prove you own the domain:

```bash
# Register your domain and get the verification token
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -X POST https://turbopentest.com/api/tlds \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'
```

Response:
```json
{
  "id": "1f0c9c4e-7a2b-4d3e-9f1a-2b3c4d5e6f70",
  "domain": "example.com",
  "status": "pending",
  "verificationToken": "abc123..."
}
```

Add a TXT record with the value `turbopentest-verify=<verificationToken>` to your DNS, then verify using the returned `id`:

```bash
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -X POST https://turbopentest.com/api/tlds/1f0c9c4e-7a2b-4d3e-9f1a-2b3c4d5e6f70/verify
```

## Step 3: Start a pentest

```bash
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -X POST https://turbopentest.com/api/pentests \
  -H "Content-Type: application/json" \
  -d '{"targetUrl": "https://example.com"}'
```

Response:
```json
{
  "id": "9b2e6f4a-1c3d-4e5f-8a7b-6c5d4e3f2a10",
  "targetUrl": "https://example.com",
  "status": "queued"
}
```

## Step 4: Check results

Poll the pentest status until it completes (typically under 2 hours):

```bash
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  https://turbopentest.com/api/pentests/9b2e6f4a-1c3d-4e5f-8a7b-6c5d4e3f2a10
```

When `status` is `"complete"`, the `findings` array contains all discovered vulnerabilities.

## Step 5: Download the report

```bash
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  https://turbopentest.com/api/pentests/9b2e6f4a-1c3d-4e5f-8a7b-6c5d4e3f2a10/report \
  -o pentest-report.pdf
```

## Next steps

- [CI/CD Integration](/docs/integrations/cicd) - Automate pentests in your pipeline
- [Understanding Results](/docs/pentesting/understanding-results) - How to read findings
- [Retest Commands](/docs/pentesting/retest-commands) - Verify your fixes