# API keys for external systems

> A team's scanner engines, issue trackers, alerts and enrichment services, and where AI and repository access are set.

Source: https://scansuite.eu/documentation/administration/configuring-api-keys-for-external-systems
Last reviewed: 2026-10-19

Some scanners, the issue trackers, alerts and enrichment services work only once you give ScanSuite the address and credentials of the service behind them. They are set for a team on the **Teams** page, which opens from the user menu. The values apply to the current team only; other teams never see them.

Team admins and operators change these settings; other members see them read-only. Saved passwords and keys are stored encrypted and never shown again: a saved secret field reads *Saved. Leave empty to keep it.* Each block has its own **Save** button.

## What is set where

| Where | What is there |
|---|---|
| Teams → Scanning | Scanner engines (OpenVAS, Acunetix), described below. Also the Team SSH key and the Server account, see Teams and roles. |
| Teams → Integrations | Issue trackers (DefectDojo, Securitm), Alerts (email, Telegram), Enrichment services (Snyk, Shodan, Dehashed), described below. |
| Teams → AI | The team's AI connections, models and per-task routing, see AI providers and cost. Only team admins change them. |
| System Settings → Shared services | What every team shares, set by a system administrator: the Nessus scanner, the Git service and the system AI. |
| My account → Repository access | Each person's own SSH key for cloning and Git repository API key. |

See [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles), [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers) and [System Settings](https://scansuite.eu/documentation/administration/platform-administration).

## AI

AI connections, models and per-task routing are on the team's **AI** tab, see [AI providers and cost](https://scansuite.eu/documentation/usage/ai-providers). Only the system AI, set up in System Settings, can use a custom CA bundle or the deployment's own cloud identity instead of a key.

## Repository access

Access to private repositories is set in three places:

| Setting | Where | What it is for |
|---|---|---|
| Team SSH key | Teams → Scanning → Team SSH key | The private key schedules, pipeline scans and members without a key of their own clone with. |
| Git service | System Settings → Shared services → Git service | GitLab, Bitbucket or GitHub for the whole installation; for Bitbucket also its address and SSH clone address pattern. |
| Personal SSH key and Git repository API key | My account → Repository access | A person's own key for the scans they start, and the key that lists repositories of a Bitbucket project. |

How they work together is described in [Git repository authentication](https://scansuite.eu/documentation/usage/static-code-analysis/git-repository-authentication).

## Scanner engines

The **Scanner engines** card on the **Scanning** tab connects the external scanners the team drives. Each block shows **Connected** once its address is saved, **Not set** before. The Nessus scanner is shared by all teams and set up by a system administrator.

### OpenVAS (infrastructure scanning)

| Field | What to enter |
|---|---|
| Address | The OpenVAS server, for example https://openvas.example.com. |
| User name | An OpenVAS account that may create and run scans. |
| Password | That account's password. |

OpenVAS can run on the same server as ScanSuite or on a separate one. Installation is described in the official [OpenVAS guide](https://greenbone.github.io/docs/latest/22.4/container/index.html).

### Acunetix (web application scanning)

| Field | What to enter |
|---|---|
| Address | The Acunetix server, for example https://acunetix.example.com:3443. |
| User name | The email address of an Acunetix account that may create and run scans. |
| Password (hashed) | Not the password itself: its SHA-256 hash in hexadecimal, the form Acunetix's sign-in expects. |

To compute the hash without leaving the password in the shell history, type it at the prompt of this command; it prints the 64-character value to paste:

```bash
read -rsp 'Acunetix password: ' p; echo; printf '%s' "$p" | sha256sum | cut -d' ' -f1; unset p
```

![Team scanner engines in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/configuring-api-keys-for-external-systems/03.png)

*The OpenVAS and Acunetix scanner engines on the Scanning tab*

## Issue trackers

The **Issue trackers** card on the **Integrations** tab sets where the team's findings are exported. Leave a tracker empty to keep findings in ScanSuite only.

| Block | Fields |
|---|---|
| DefectDojo | Address (for example https://dojo.example.com:8443) and API key. See Set up DefectDojo. |
| Securitm | Address and API key, to export findings to Securitm. See Export to Securitm. |

See [Set up DefectDojo](https://scansuite.eu/documentation/installation/set-up-defectdojo) and [Export to Securitm](https://scansuite.eu/documentation/usage/working-with-scan-results/export-to-securitm).

## Alerts

The **Alerts** card on the same tab says where the team hears that a scan found a new asset or changed an asset's risk.

| Block | Field | What to enter |
|---|---|---|
| Email | Mail server | Host, with an optional port: smtp.example.com:587. Without a port, 587 is used. |
| Email | Send to | Recipient addresses separated by commas. |
| Email | Send from | The sender address. |
| Email | Sender password | The sender account's password on the mail server. |
| Telegram | Chat ID | The chat the alerts go to. |
| Telegram | Bot token | From @BotFather. Add the bot to the chat first. |

## Enrichment services

The **Enrichment services** card on the same tab holds API keys for services that add context to findings and assets. Empty fields keep the saved key.

| Field | What it adds | Where the key comes from |
|---|---|---|
| Snyk | Dependency vulnerability data for the Snyk-based scanners. | Sign in at app.snyk.io, enable Snyk Code in the organisation settings, then create an API token in your account settings. |
| Shodan | What the internet sees on the hosts an OSINT scan finds: open services and known vulnerabilities. | The Shodan developer page: developer.shodan.io. |
| Dehashed | Leaked credentials for the domains an OSINT scan checks. | Your account at dehashed.com. |

## Enter the values

1. **Open Teams from the user menu**

   If you belong to several teams, pick the right one in the team list at the top of the page first.
2. **Go to the tab and card**

   For example Integrations → Issue trackers → DefectDojo, or Scanning → Scanner engines → OpenVAS.
3. **Fill in the fields**

   Exactly as the service issued them. Leave a saved secret field empty to keep its value.
4. **Click Save in that block**

   The toast says Saved. Scanner engines, trackers and alerts then show Connected next to their name, and the Overview tab counts them under Integrations.

> **A person does this step:** Typing an API key, password or bot token into these fields is a person's step.
>
> An AI agent must not ask for these values in the chat.

**Check:** a saved block shows **Connected**, which means the values are stored; it does not test them. The first scan or export that uses the service shows whether it accepted them; DefectDojo exports are checked as described in [Set up DefectDojo](https://scansuite.eu/documentation/installation/set-up-defectdojo).

![Team integrations in ScanSuite](https://scansuite.eu/static/assets/img/docs/administration/configuring-api-keys-for-external-systems/02.png)

*Issue trackers, alerts and enrichment services on the Integrations tab*