Stop scams inside your product with one API call.

Quick start

Live in three steps.

Your key stays on your server. Your website sends links or messages to your own backend, your backend asks SafeHop, and you decide what to show.

1. 1

   Get your key

   Sign in with Google or your work email. The key is shown once. 1,000 free credits a month.

   Get a free key
2. 2

   Store it as a secret

   Put it in your server's environment, not in your code or website. If it ever leaks, sign in again to get a new one.

   .envCopy

   # .env on your server: never commit it, never put the key in browser code
   SAFEHOP_API_KEY=sh_live_your_key_here

3. 3

   Check links from your server

   Call SafeHop before a link or message is shown to other people, and act on the verdict.

   Node.jsPHPPythoncURL

   Copy

   // Node.js 18+ (built-in fetch). Runs on your server, never in the browser.
   export async function checkLink(url) {
     try {
       const res = await fetch('https://api.safehop.app/v1/scan/url', {
         method: 'POST',
         headers: {
           Authorization: `Bearer ${process.env.SAFEHOP_API_KEY}`,
           'content-type': 'application/json',
         },
         body: JSON.stringify({ url }),
         signal: AbortSignal.timeout(10000),
       });
       return res.ok ? await res.json() : null;
     } catch {
       return null; // SafeHop unreachable: let the content through
     }
   }
   
   const result = await checkLink(linkFromUser);
   if (result?.verdict === 'dangerous') {
     // block it, or show result.reasons[0].text to the user
   }

   <?php
   function safehop_check_link(string $url): ?array {
       $ch = curl_init('https://api.safehop.app/v1/scan/url');
       curl_setopt_array($ch, [
           CURLOPT_POST => true,
           CURLOPT_RETURNTRANSFER => true,
           CURLOPT_TIMEOUT => 10,
           CURLOPT_HTTPHEADER => [
               'Authorization: Bearer ' . getenv('SAFEHOP_API_KEY'),
               'Content-Type: application/json',
           ],
           CURLOPT_POSTFIELDS => json_encode(['url' => $url]),
       ]);
       $body = curl_exec($ch);
       $ok = curl_getinfo($ch, CURLINFO_HTTP_CODE) === 200;
       curl_close($ch);
       return $ok ? json_decode($body, true) : null; // null: let the content through
   }
   
   $result = safehop_check_link($linkFromUser);
   if ($result && $result['verdict'] === 'dangerous') {
       // block it, or show $result['reasons'][0]['text']
   }

   import os
   import requests
   
   def check_link(url):
       try:
           r = requests.post(
               "https://api.safehop.app/v1/scan/url",
               headers={"Authorization": f"Bearer {os.environ['SAFEHOP_API_KEY']}"},
               json={"url": url},
               timeout=10,
           )
           return r.json() if r.ok else None
       except requests.RequestException:
           return None  # SafeHop unreachable: let the content through
   
   result = check_link(link_from_user)
   if result and result["verdict"] == "dangerous":
       ...  # block it, or show result["reasons"][0]["text"]

   curl https://api.safehop.app/v1/scan/url \
     -H "Authorization: Bearer $SAFEHOP_API_KEY" \
     -H "content-type: application/json" \
     -d '{"url":"paypal-account-verify-center.shop/login"}'

   Verdict	What to do
   safe	Let it through
   suspicious	Show a warning with reasons[0].text
   dangerous	Block it, or ask the user to confirm

   Good practice

   • Never put the key in browser JavaScript or a mobile app; anyone could copy it.
   • If SafeHop does not answer within 10 seconds, let the content through.
   • Cache the result for a link for a few hours to save credits.
   • For whole SMS, chat or email text, use POST /v1/scan/message with {"text": "…"}.