Before putting a Shodan API key into application code, call the official api-info endpoint to confirm validity, plan, and quotas.
Shortest check
Validate with one curl request
curl -X GET "https://api.shodan.io/api-info?key={YOUR_API_KEY}"Replace {YOUR_API_KEY} locally. Do not share the command, terminal screenshot, or browser URL when it contains the real secret.
How to read common fields
| Field | Meaning | What to check |
|---|---|---|
plan | Current API plan identifier | Confirm it matches the delivery description |
query_credits | Remaining query credits | Relevant to filters, paging, and downloads |
scan_credits | Remaining scan credits | Generally one credit per scanned IP under current rules |
monitored_ips | Monitored IP capacity or state | Relevant to network monitoring capabilities |
unlocked | Whether some results or endpoints are unlocked | Output varies by plan; use the live response |
Recommended validation order
- 1Check HTTP status
A valid request returns JSON. Investigate the key and request format after 401 or 403 errors.
- 2Confirm the plan
Do not judge the key from one credit value alone.
- 3Record initial quotas
Keep a private delivery-time record for later troubleshooting.
- 4Run one minimal query
Validate code and network behavior before adding filters, paging, or bulk work.
Do not store the API key here
- Do not commit it to Git or embed it in frontend JavaScript.
- Keep it out of screenshots, logs, telemetry, and public chats.
- Use environment variables or a secret manager in production.
- If exposed, stop using it and contact the responsible provider.
References
This article supports product understanding, development learning, and lawful authorized use. Third-party documentation, software versions, and platform rules may change.
Frequently asked questions
What should I do after a 401 or 403 response?
Check that the key is complete, contains no whitespace, and that the URL is correct. If it still fails, confirm the key state and plan. Never post the real key in a public chat or screenshot.
Does query_credits equal to zero block all searches?
Not necessarily. Credit consumption depends on filters, pagination, and endpoints.
Can I validate the key in a browser address bar?
Technically yes, but browser history, screen recordings, and shared devices can expose it. Prefer a controlled terminal or secret-aware client.