Public API and API Keys

With the AutoPhish public API you can automate tasks you would otherwise do in the app – for example creating campaigns, keeping target lists in sync or pulling results into your own reporting. This article explains how to create an API key and how to authenticate.

What you can do with the API

The API covers the main areas of AutoPhish:

• Companies and company settings (context, logo, verified e-mail domains)
• Campaigns – create, update, clone, schedule and cancel, plus their executions
• Target lists and targets
• Reports – summary, targets, trends and export
• Team members and invitations
• Domains, security scans and issues
• Reported phishing e-mails
• Audit log and Directory Sync

The full reference is available as interactive OpenAPI documentation at https://autophish.io/docs/api. The OpenAPI spec itself can be downloaded from /api/v1/openapi.json or /api/v1/openapi.yaml.

Create an API key

1. Go to Settings → API Keys.
2. Under Create API key, enter a Name (for example "Reporting integration").
3. Optionally enter Allowed IPs – one per line or comma-separated. Only IPv4/IPv6 addresses are supported, no ranges yet. Leave it empty to allow any IP.
4. Under Companies, select the companies this key may access.
5. Choose the Scopes the key needs, or use a preset:
6. • Read-only – read company, campaigns, targets, reports, team and integrations
   • Campaign automation – read company, read and write campaigns and targets, read reports
   • Admin operations – read and write company and team settings
6. Click Create key.

The token is shown only once. Copy it with Copy and store it securely, for example in your password manager or secret store. Tokens start with apk_.

Grant only the scopes an integration really needs, and restrict keys to fixed IP addresses where possible.

Authenticate your requests

Send the key as a bearer token and name the company in every request:

Authorization: Bearer apk_...
X-Company-Id: <your company ID>

The company IDs are shown next to each company in the Companies section of the API Keys page. The X-Company-Id header is required even if the key has access to only one company. https://autophish.io/api/v1/ is the base URL of all endpoints.

Requests are rate-limited per key and company. The current limits are returned in X-RateLimit-* headers; if you exceed them, the API answers with status 429.

Manage and revoke keys

The table Your API keys shows each key with its prefix, scopes, allowed IPs, last use and status. You can change which companies a key may access, and Revoke a key at any time – this cannot be undone.

Who can create keys

• You can assign a key only to companies in which you are an admin or the owner.
• A key keeps working only as long as its creator remains admin or owner of that company. If a member is removed, their keys lose access to that company.
• Company owners see External API keys with company access – keys created by other users – and can remove their access with Remove access.

Creating, changing and revoking keys, as well as every API call, are recorded in the Audit Log.

Updated on: 28/10/2026