> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Public API and API Keys

With the AutoPhish public API you can automate tasks you would otherwise do in the app – for example creating campaigns, keeping target lists in sync or pulling results into your own reporting. This article explains how to create an API key and how to authenticate.

## What you can do with the API

The API covers the main areas of AutoPhish:

- Companies and company settings (context, logo, verified e-mail domains)
- Campaigns – create, update, clone, schedule and cancel, plus their executions
- Target lists and targets
- Reports – summary, targets, trends and export
- Team members and invitations
- Domains, security scans and issues
- Reported phishing e-mails
- Audit log and Directory Sync

The full reference is available as interactive OpenAPI documentation at https://autophish.io/docs/api. The OpenAPI spec itself can be downloaded from `/api/v1/openapi.json` or `/api/v1/openapi.yaml`.

## Create an API key

1. Go to **Settings → API Keys**.
2. Under **Create API key**, enter a **Name** (for example "Reporting integration").
3. Optionally enter **Allowed IPs** – one per line or comma-separated. Only IPv4/IPv6 addresses are supported, no ranges yet. Leave it empty to allow any IP.
4. Under **Companies**, select the companies this key may access.
5. Choose the **Scopes** the key needs, or use a preset:
   - **Read-only** – read company, campaigns, targets, reports, team and integrations
   - **Campaign automation** – read company, read and write campaigns and targets, read reports
   - **Admin operations** – read and write company and team settings
6. Click **Create key**.

![Create API key form with name, allowed IPs, companies and scopes](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/api-keys_vdi2fs.jpg)


The token is shown **only once**. Copy it with **Copy** and store it securely, for example in your password manager or secret store. Tokens start with `apk_`.

Grant only the scopes an integration really needs, and restrict keys to fixed IP addresses where possible.

## Authenticate your requests

Send the key as a bearer token and name the company in every request:

```
Authorization: Bearer apk_...
X-Company-Id: <your company ID>
```

The company IDs are shown next to each company in the **Companies** section of the API Keys page. The `X-Company-Id` header is required even if the key has access to only one company. `https://autophish.io/api/v1/` is the base URL of all endpoints.

Requests are rate-limited per key and company. The current limits are returned in `X-RateLimit-*` headers; if you exceed them, the API answers with status 429.

## Manage and revoke keys

The table **Your API keys** shows each key with its prefix, scopes, allowed IPs, last use and status. You can change which companies a key may access, and **Revoke** a key at any time – this cannot be undone.

## Who can create keys

- You can assign a key only to companies in which you are an admin or the owner.
- A key keeps working only as long as its creator remains admin or owner of that company. If a member is removed, their keys lose access to that company.
- Company owners see **External API keys with company access** – keys created by other users – and can remove their access with **Remove access**.

Creating, changing and revoking keys, as well as every API call, are recorded in the **Audit Log**.