API keys (BYOK)
Why OSINT UI uses your own API keys, how to add them, and which providers each tool needs.
Why BYOK (Bring Your Own Key)
Most PRO tools query external providers (Shodan, VirusTotal, Hunter, IPinfo...). Instead of a shared key pool across every user — which runs out fast and breaks "for everyone at once" — each user connects their own keys, almost always on the provider's free tier. The result: your quota is never spent by someone else, and you decide which sources to enable.
No tool requires every key to be configured. Without one, any source that depends on that API is simply skipped and the rest still works with what you do have.
Adding a key
- Open Settings → API Keys inside the app.
- Pick the provider from the list (each links directly to its own signup page).
- Paste the key — it's encrypted with AES-256-GCM before being stored; it's never shown in plaintext again, only replaced or deleted.
Most-used providers
| Provider | Free tier | Tools that use it |
|---|---|---|
| Shodan | Yes (limited) | Domain Analyzer, Port Scanner, IP Analyzer |
| VirusTotal | Yes | Reputation Checker, URL Scanner, Hash Analyzer, IP Analyzer |
| Hunter.io | Yes (limited) | Email Analyzer, Domain Analyzer |
| IPinfo | Yes (limited) | Domain Analyzer, IP Analyzer |
| AbuseIPDB | Yes | Reputation Checker, IP Analyzer |
| NumVerify / Veriphone | Yes (limited) | Phone Analyzer |
| OpenCage | Yes (limited) | Phone Analyzer, Metadata Extractor |
| Google Cloud Vision | With billing enabled | Reverse Image Lookup |
| FaceCheck.ID | Paid | Reverse Image Lookup (facial recognition) |
The full catalog, with each provider's signup link, lives inside the app under Settings → API Keys.
Keyless exceptions
Some sources are public and need no key at all: GreyNoise Community, ip-api.com, HackerTarget, crt.sh, robots.txt/sitemap.xml, and the WhatsMyName dataset behind Username Analyzer's extended mode, among others.
Key security
- AES-256-GCM encryption server-side, never plaintext.
- Never exposed to other users or shared between accounts (except Intelligence X, which has a shared server key as a fallback when you haven't set your own).
- You can revoke or replace them at any time without affecting the rest of your account.
See also REST API: API access tokens (PATs) are a different mechanism — they authenticate your own calls to /api/v1, they don't replace the provider keys above.