Build on the CheckLeaked API

REST API

Plain HTTPS and JSON. Every request carries your key in a header, and every answer is JSON you can read from any language.

Base URL

https://api.checkleaked.cc/api

Authentication

api-key: <your key>Send your key in the api-key header on every request.

Your key

Your bot token is your API key. Sign in and copy it from the bot links page. Open bot links

Rate limit

Two requests per second, per key and per IP. What a key can search depends on its plan.

Reference

Every endpoint, parameter and response, with requests you can try in the browser. api.checkleaked.cc/docsopenapi.json

Your first request

GET /valid checks that a key works and answers with its plan. It runs no search.

curl https://api.checkleaked.cc/api/valid \
  -H "api-key: YOUR_API_KEY"

Replace YOUR_API_KEY with your own key. A missing or wrong key gets 401 Unauthorized.

What the API covers

The API reference groups its endpoints into these areas.

• Private botsRun the CheckLeaked commands under your own Discord or Telegram bot (Pro and Plus).
• WebhooksSigned HMAC-SHA256 webhooks for tracking findings, formatted for Slack, Discord, Teams and Google Chat or sent as generic JSON.
• AuthenticationCheck that a key is valid and read its subscription.
• LeakCheck SearchBreached-credential search by email, username, domain, phone, hash and more.
• LeakRadar Raw SearchSearch the raw stealer-log corpus and read individual leak blocks (Plus and Pro, uses credits).
• LeakRadar SearchCredential-leak search by email, username or advanced filters, with unlock and export (Plus and Pro).
• LeakRadar DomainDomain exposure: a summary, leaks by bucket, exposed subdomains and URLs, and a full report.
• LeakRadar Dark WebSearch and read indexed dark-web forum and market posts (Plus and Pro).
• LeakRadar UtilitiesPassword range and pwned-password checks, cross-source checks, search history and async task polling.
• Dehashed SearchSearch Dehashed data by email, username, IP address, name and more.
• Experimental SearchSearch the experimental and Snusbase databases.
• Hash CrackingTry to reverse MD5, SHA1, SHA256 and other password hashes.
• IP LookupGeolocation, ISP and network details for any IP address.
• Domain WHOISRegistrar, dates, name servers, registrant and status for any domain.
• Google HuntOSINT on Gmail addresses: profile details, linked services and public data (Pro and Plus).
• Deep Search AIAI intelligence reports over findings you already fetched, a PDF export and a WormGPT web investigation (Pro).
• TrackingMonitor emails, usernames or domains and get an alert when new breach data appears.
• Tracking LeakRadarMonitor domains and raw-search queries in LeakRadar for new exposure.
• HIBPHave I Been Pwned v3: breaches, data classes, the k-anonymity password check and claimed domains.

Node.js and TypeScript SDK

checkleakedcc is the official client. It is fully typed, ships ESM and CommonJS with no runtime dependencies, and retries rate limits and transient errors for you. It needs Node.js 20 or newer.

npm i checkleakedcc

import CheckLeakedCC from 'checkleakedcc';

const api = new CheckLeakedCC('YOUR_API_KEY');

// Validate the key and read your plan
console.log(await api.valid());

// Breach search for an email address
const result = await api.leakCheck('[email protected]', 'email');
console.log(result);

MCP server for AI assistants

The Model Context Protocol server lets Claude, VS Code with GitHub Copilot, Cursor and other MCP clients run breach searches, hash cracking, IP lookups and breach monitoring for you.

Endpoint

https://mcp.checkleaked.cc/mcp

Authentication

Authorization: Bearer <your key>Your API key, sent as a bearer token.

{
  "mcpServers": {
    "checkleaked": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.checkleaked.cc/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer YOUR_API_KEY"
      }
    }
  }
}

{
  "servers": {
    "checkleaked": {
      "type": "http",
      "url": "https://mcp.checkleaked.cc/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Signed in, the bot links page also has setup steps for ChatGPT, Claude.ai, Cursor and Windsurf. Open bot links

Integrations

Prefer a managed platform? The same data is available where you already work.

• Apify actor

  Run the CheckLeaked breach and OSINT suite as a managed Apify actor, from the Apify console, its API or a schedule.

  Open on Apify

• RapidAPI

  Subscribe to the official CheckLeaked API on the RapidAPI marketplace and call it with your RapidAPI key.

  Open on RapidAPI