— Configuration

Getting and managing your API key.

Your API key is the credential that connects vScan to the AskarLabs vulnerability feed. It is permanently bound to the first domain it is saved on.

⏱ 4 min read Updated June 22, 2026 Beginner Applies to WordPress

Get a key

API keys are issued when you sign up for vScan at askarlabs.com/vscan. After signing up:

  1. Check your email for a message from AskarLabs containing your API key and the API Base URL.
  2. If you are on a paid plan, you will also receive a portal access email where you can manage all of your keys.
  3. Copy the key before closing the email, treat it like a password.

If you did not receive the email, check your spam folder. You can also request a resend from the portal or by contacting support.

Key format

vScan API keys are 64-character lowercase hexadecimal strings:

c775e7b757ede630cd0aa1113bd102661ab38829ca52a6422ab782862f2686e1

The plugin validates this format client-side before sending the key to the API.

Domain binding

The first time you save an API key in the plugin settings, it is permanently bound to the domain of that WordPress installation. The binding is enforced server-side.

Implications:

  • You cannot use the same key on a different domain.
  • Changing your domain (e.g. migrating from staging.example.com to example.com) requires a new key.
  • For agencies or freelancers managing multiple sites, each site needs its own key.

Warning: Always connect your key on the production domain first. Binding to a staging or development URL will prevent you from using the key on production without contacting support to reset the binding.

Key expiry

Free plan keys expire periodically and can be regenerated from the website before they lapse. Premium plan keys stay valid for as long as your subscription is active.

If your key is deactivated, the plugin will show a “Key expired” badge on the Settings page and scans will stop running.

Renewing a key

To renew or replace a key:

  1. Log in to the AskarLabs portal (link in your original signup email).
  2. Navigate to Keys and generate a new key, or renew the existing one.
  3. If you are replacing an old key, first disconnect the old key from the plugin via vScan → Settings → Disconnect.
  4. Enter the new key and click Connect.

Your scan history is preserved across key changes as long as you do not uninstall the plugin.