Skip to main content

CTI API Keys

CrowdSec CTI information can be navigated in the WEB UI but for those who want to integrate CrowdSec's CTI into their tools and workflows, an API access is available through self-service API keys.
There are different quota options, from keys included in the current plan to higher-volume keys available as options to the premium plan.

Community Plan Free Key — 40 / month · Testing integrations, personal servers, ad-hoc lookups
Premium Plan Free Key — 120 / month · Regular enrichment, small SOC teams, recurring automationPremium
Premium Keys Options — 5K · 25K · 100K / month · Production SIEMs, SOARs, high-volume pipelines — requires PremiumPremium

API quotas are separate from Web UI quotas. Unused quota does not roll over.

Create CTI API Keys​

  • Click the + in the top right corner.
  • Alternatively you can also click the + New Key in the Settings → CTI API Keys page.
CrowdSec Create API Key DropdownCrowdSec Create API Key Dropdown

There, you can choose among the various quota options. A free key is always available to test your integrations — the quota is higher if your organization is on a Premium plan.

CrowdSec Create API Key PageCrowdSec Create API Key Page
  • Purchasing a CTI API Key does not grant access to a Premium Plan trial.
  • Purchasing a CTI API Key while a trial is active will immediately end the trial.
  • Cancelled CTI API Keys are non-refundable and will not be prorated — the full price remains due regardless of when the cancellation occurs.

The Advanced Search Lucene query interface available in the Console is a Web UI feature only — it is not accessible through self-service API keys. Programmatic access to bulk Lucene-style querying requires an Advanced CTI plan. Contact our team to discuss your use case.

Using the API​

CrowdSec provides ready-made integrations for the most common security platforms — SIEM, SOAR, TIP, and investigation tools. If your platform is listed, that's the fastest way to get started.

If you prefer to use your own scripts, call the API directly from the command line, or build custom playbooks, the API is a straightforward REST interface authenticated with your key.

More ways to learn

More ways to learn

Watch a short series of videos on how to get the most out of CrowdSec's Cyber Threat Intelligence database

Learn with CrowdSec Academy