One of the most common use cases for HIBP’s API is querying by email address, and we support hundreds of millions of searches against this endpoint every month. Loads of organisations use this service to understand the exposure of their customers and provide them with better protection against account takeover attacks. Many also use it to support customers who’ve already fallen victim – “hey, did you know HIBP says you’re in 7 data breaches, any chance you’ve been reusing passwords?” Some companies even use it to help establish the legitimacy of an email address; we’re all so pwned that if an address isn’t pwned, maybe it isn’t even real.
The latest video demo walks you through how to use this API and introduces something new that has been requested for years: a test API key. We’ve had this request so many times, and my response has usually been something to the effect of “mate, a key is a few bucks, just get a cheapie and start writing code”. However, even if it were just a few cents, it would still pose a burden to some for various reasons. So, today we’re also launching a test key:
hibp-api-key: 00000000000000000000000000000000The test key can only be used for queries against the test accounts (and we’ve had those for many years now), but it allows developers to start immediately writing code against the real live APIs. The technical implementation is identical to the key you get when you have a paid subscription, so this should help a bunch of people really fast-track their development and remove that one little barrier we previously had. Here’s how it all works:
So, that’s the breached account API, and it comes off the back of last week’s first demo, showing how domain searches work. We’ve got a heap more to add yet and I’d love to hear about and others you feel would help you get the most out of the service.
