Configuring API keys for external systems

To enable specific security scanning and AI-powered analysis features, API keys must be configured in ScanSuite. They belong to a team: team admins and operators open Team integrations in the user menu, and the values apply to the current team only. Other teams never see them, and stored passwords and keys are never shown again.

zoom_inEnlarge

OpenVAS (infrastructure scans)

ScanSuite requires OpenVAS credentials to execute infrastructure scans.

• Specify the OpenVAS URL, username and password in Team integrations.
• OpenVAS can be installed on either the same host as ScanSuite or a separate server.
• Follow the official OpenVAS installation guide.

AI provider (AI-powered features)

The AI engines — static analysis, web scanning, the pentest agent, generated rules and documentation — all run through the team's AI configuration, chosen under Teams → Team settings → AI provider: the platform default, a team override, or no AI (see AI providers and cost). A team override, and the system default in administration, take the fields below. Choose the provider first; the fields change accordingly.

OpenAI-compatible

Any endpoint implementing the OpenAI API specification works, so this covers hosted OpenAI, compatible gateways, and models running locally on the internal network.

• Obtain a hosted API key at OpenAI API key management.
• Or set up a connection to an LLM on the local network — see Ollama OpenAI compatibility. Serve it over HTTPS, for example behind a reverse proxy. If its certificate comes from an internal CA, configure it as the system default in administration, which can name a CA bundle; a team override cannot.

Vertex AI Anthropic

Claude models served through Google Cloud Vertex AI.

Dehashed (leaked credentials, OSINT)

A Dehashed API key is required to query leaked credentials for domain names analysed during an infrastructure OSINT scan.

• Obtain an API key at dehashed.com.

Shodan (OSINT scans)

A Shodan API key is required to check for known services and vulnerabilities on hosts discovered during an infrastructure OSINT scan.

• Obtain an API key at Shodan API key management.

Snyk (SCA and SAST scans)

A Snyk API key is required for Snyk-based security scans. Obtain a free key as follows:

1. 01
   Create a Snyk account

   Sign up or log in at app.snyk.io.

2. 02
   Enable Snyk Code

   Under the organisation settings, enable Snyk Code for static code analysis.

3. 03
   Generate an API token

   From the Snyk account settings, create and copy the auth token.

Other integrations on this page

Entering the keys

1. 01
   Open Team integrations in the user menu
2. 02
   Locate the respective fields
3. 03
   Enter the keys exactly as provided by the respective platforms
4. 04
   Click Save to apply the settings

zoom_inEnlarge