Shodan API
api.shodan.io · Security
Search engine for internet-connected devices — discover open ports, running services, banners, and vulnerabilities across the internet. Essential for security research and asset discovery.
Authentication
API Key authentication
API key from shodan.io. Free account includes limited credits. Pass as ?key= query parameter.
Sample Requests
GET
Get host info
Get all information Shodan has on an IP address.
https://api.shodan.io/shodan/host/8.8.8.8?key=YOUR_KEY
Hover any highlighted part to learn what it does
curl -X GET "https://api.shodan.io/shodan/host/8.8.8.8?key=YOUR_KEY"
import requests
params = {
"key": "YOUR_KEY"
}
response = requests.get(
"https://api.shodan.io/shodan/host/8.8.8.8",
params=params,
)
print(response.json())const url = new URL('https://api.shodan.io/shodan/host/8.8.8.8');
url.searchParams.set('key', 'YOUR_KEY');
const response = await fetch(url);
const data = await response.json();
console.log(data);package main
import (
"fmt"
"io"
"net/http"
"net/url"
)
func main() {
baseURL, _ := url.Parse("https://api.shodan.io/shodan/host/8.8.8.8")
q := baseURL.Query()
q.Set("key", "YOUR_KEY")
baseURL.RawQuery = q.Encode()
targetURL := baseURL.String()
req, _ := http.NewRequest("GET", targetURL, nil)
client := &http.Client{}
resp, _ := client.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}require "net/http"
require "json"
uri = URI("https://api.shodan.io/shodan/host/8.8.8.8")
uri.query = URI.encode_www_form({
"key" => "YOUR_KEY"
})
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"
req = Net::HTTP::Get.new(uri)
res = http.request(req)
puts JSON.parse(res.body)<?php
$url = "https://api.shodan.io/shodan/host/8.8.8.8?" . http_build_query([
"key" => "YOUR_KEY"
]);
$opts = ["http" => [
"method" => "GET",
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));
GET
Search Shodan
Search for US nginx servers.
https://api.shodan.io/shodan/host/search?key=YOUR_KEY&query=nginx country:US&facets=org,os
Hover any highlighted part to learn what it does
curl -X GET "https://api.shodan.io/shodan/host/search?key=YOUR_KEY&query=nginx%20country%3AUS&facets=org%2Cos"
import requests
params = {
"key": "YOUR_KEY",
"query": "nginx country:US",
"facets": "org,os"
}
response = requests.get(
"https://api.shodan.io/shodan/host/search",
params=params,
)
print(response.json())const url = new URL('https://api.shodan.io/shodan/host/search');
url.searchParams.set('key', 'YOUR_KEY');
url.searchParams.set('query', 'nginx country:US');
url.searchParams.set('facets', 'org,os');
const response = await fetch(url);
const data = await response.json();
console.log(data);package main
import (
"fmt"
"io"
"net/http"
"net/url"
)
func main() {
baseURL, _ := url.Parse("https://api.shodan.io/shodan/host/search")
q := baseURL.Query()
q.Set("key", "YOUR_KEY")
q.Set("query", "nginx country:US")
q.Set("facets", "org,os")
baseURL.RawQuery = q.Encode()
targetURL := baseURL.String()
req, _ := http.NewRequest("GET", targetURL, nil)
client := &http.Client{}
resp, _ := client.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}require "net/http"
require "json"
uri = URI("https://api.shodan.io/shodan/host/search")
uri.query = URI.encode_www_form({
"key" => "YOUR_KEY",
"query" => "nginx country:US",
"facets" => "org,os"
})
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = uri.scheme == "https"
req = Net::HTTP::Get.new(uri)
res = http.request(req)
puts JSON.parse(res.body)<?php
$url = "https://api.shodan.io/shodan/host/search?" . http_build_query([
"key" => "YOUR_KEY",
"query" => "nginx country:US",
"facets" => "org,os"
]);
$opts = ["http" => [
"method" => "GET",
]];
$ctx = stream_context_create($opts);
$res = file_get_contents($url, false, $ctx);
print_r(json_decode($res, true));Postman Setup Guide
- Create a free account at shodan.io to get an API key
- Pass key=YOUR_KEY as query param
- Host info: GET /shodan/host/{ip}?key=YOUR_KEY
- Search: GET /shodan/host/search?query=apache+port:80&key=YOUR_KEY
- Note: search credits are limited on free accounts
What can you build with Shodan API?
Shodan API is a Security API. Developers commonly use security APIs for:
- adding multi-factor authentication to your app
- validating identity documents and biometrics
- monitoring for data breaches and leaked credentials
- running background checks and fraud screening
- scanning code and infrastructure for vulnerabilities
API Key authentication. You'll receive a key after signing up. Send it with every request — in a header or query parameter. Keep it out of client-side code and never commit it to version control. Shodan API is free to use up to a usage limit, making it a low-risk choice to experiment with.
New to APIs? Read our beginner's guide