Authentication
Choose the authentication method that matches the identity making the request: an integration, an application acting for a user, or a person signing in to ThreatPrevent.
API keys
Authenticate a trusted server or private integration to the ThreatPrevent API.
x-api-key HTTP header
OAuth 2.0
Delegate scoped API access to registered applications. OAuth clients do not configure workforce sign-in.
Client Credentials, Authorization Code + PKCE and Device Authorization
Enterprise SSO
Authenticate people to the customer portal and browser extension through their company identity provider.
OpenID Connect with Microsoft Entra ID
API key header
Use this option for existing private integrations.
x-api-key: tp_xxxxxxxxxxxxxxxxxxxxxxxxxAPI key handling
Keep keys server-side
Never embed a secret API key in public JavaScript, distributed browser extensions or public repositories.
Use secret storage
Store production keys in a secret manager or protected server environment.
Rotate on exposure
Disable any key that may have been disclosed and issue a replacement.
Separate integrations
Use distinct keys for different systems so usage and compromise can be isolated.
OAuth authorises applications to call the API. Enterprise SSO signs employees into the ThreatPrevent portal and browser extension.