Deployment

Configuring API keys for external systems

AI providers, scanners and third-party services that need credentials.

To enable specific security scanning and AI-powered analysis features, API keys must be configured in ScanSuite. Open the Settings menu:

ScanSuite settings menu
Opening the Settings menu

OpenVAS (infrastructure scans)

ScanSuite requires OpenVAS credentials to execute infrastructure scans.

  • Specify the OpenVAS URL, username and password in the ScanSuite settings.
  • OpenVAS can be installed on either the same host as ScanSuite or a separate server.
  • Follow the official OpenVAS installation guide.

AI provider (AI-powered features)

The AI engines — static analysis, web scanning, the pentest agent, generated rules and documentation — all run through the provider configured here. Choose one from the Provider dropdown; the fields below it change accordingly.

OpenAI-compatible

Any endpoint implementing the OpenAI API specification works, so this covers hosted OpenAI, compatible gateways, and models running locally on your own network.

FieldDescription
OpenAI API URLThe API base URL. Point this at a local runtime for an offline deployment.
OpenAI API keyYour API key.
OpenAI modelThe model identifier to use for generation.

Vertex AI Anthropic

Claude models served through Google Cloud Vertex AI.

FieldDescription
Google Cloud project IDThe project hosting the Vertex AI endpoint.
Vertex AI regionThe region the model is served from.
Claude model IDThe Claude model identifier.
Maximum output tokensUpper bound on generated tokens per request.
CA bundle pathCustom CA bundle, for deployments behind a TLS-inspecting proxy.
SSL verificationLeave enabled unless a corporate proxy makes verification impossible.

Disabling SSL verification means the platform will not detect an intercepted connection to the model provider. Prefer supplying a CA bundle path instead.

LLM generations language, under Additional Settings, controls the language the models write their findings and reports in. Token usage is recorded per scan and shown as prompt, completion and total token counters on the same settings page, so the cost of an engagement is visible.

Dehashed (leaked credentials, OSINT)

A Dehashed API key is required to query leaked credentials for domain names analysed during an infrastructure OSINT scan.

Shodan (OSINT scans)

A Shodan API key is required to check for known services and vulnerabilities on hosts discovered during an infrastructure OSINT scan.

Snyk (SCA and SAST scans)

A Snyk API key is required for Snyk-based security scans. Obtain a free key as follows:

  1. 01
    Create a Snyk account

    Sign up or log in at app.snyk.io.

  2. 02
    Enable Snyk Code

    Under your organisation settings, enable Snyk Code for static code analysis.

  3. 03
    Generate an API token

    From your Snyk account settings, create and copy your auth token.

Other integrations on this page

SectionWhat it configures
Defect DojoURL and API key for the vulnerability management system. Covered in Set up DefectDojo.
AcunetixURL, username and hashed password for web application scans.
SecuritmURL and API key, for exporting findings to Securitm.
Email alertsSMTP server, sender address, sender password and the recipient list for scan notifications.
Telegram alertsChat ID and bot key for scan notifications.
Git repositoryRepository type, Bitbucket URL template, repository API key and SSH keys used to clone code for static analysis.
Nessus runs limitCaps the number of concurrent Nessus scans.
Scan targets whitelistRestricts which targets the platform is permitted to scan.

Entering the keys

  1. 01
    Navigate to ScanSuite Settings
  2. 02
    Locate the respective fields
  3. 03
    Enter the keys exactly as provided by the respective platforms
  4. 04
    Click Save to apply the settings
ScanSuite API key settings
API key fields in the ScanSuite settings

Last reviewed 2026-08-15