What is an NVD API key?

An NVD API key is a free credential issued by NIST that raises the rate limit for the National Vulnerability Database REST APIs. Without a key you are limited to 5 requests per rolling 30-second window; with a key that rises to 50 requests per 30-second window. The key is a UUID-format string you send in the apiKey request header.

How do I get an NVD API key?

Request one from the NVD developers page at nvd.nist.gov/developers/request-an-api-key. You provide an email address and organization name, agree to the terms, and NIST emails you a single-use activation link. Activating it reveals your key. The process is free and usually takes only a few minutes.

Why do vulnerability scanners need an NVD API key?

Scanners that query or synchronize NVD data make many requests, and the unauthenticated limit of 5 requests per 30 seconds is roughly one request every 6 seconds, which makes a full sync painfully slow. A key raises the ceiling tenfold, so syncing the CVE dataset or enriching findings with CVSS and CPE data completes in a fraction of the time.

How do I send the NVD API key in a request?

Send it as an HTTP request header named apiKey, not as a URL query parameter. For example, curl -H 'apiKey: YOUR-KEY' against the CVE API 2.0 endpoint. Keep the key secret by storing it in an environment variable or secret manager rather than committing it to source control.

Does an API key remove the NVD rate limit entirely?

No. It raises the limit to 50 requests per rolling 30-second window but does not remove it. NIST still recommends adding a small delay between requests and using pagination and incremental date filters to avoid hitting the ceiling. Well-behaved clients sleep between pages rather than firing requests as fast as possible.

Data sources

NVD API Key: How to Get One and Why Scanners Need It

Name: ScanRook
Author: ScanRook

Published August 3, 2026 · 8 min read

If your vulnerability scanner talks to the National Vulnerability Database and feels slow, an NVD API key is almost certainly the fix. It is free, takes minutes to get, and raises your rate limit tenfold. This guide covers how to request one, how to use it correctly, and why scanners lean on NVD data in the first place.

Requesting and using an NVD API key for vulnerability scanning

What the NVD API is

The National Vulnerability Database, run by NIST, publishes machine-readable REST APIs so tools can pull CVE data programmatically instead of scraping the website. The one most scanners use is the CVE API 2.0 at services.nvd.nist.gov/rest/json/cves/2.0, with companion APIs for CPE product data and CVE change history. Each CVE record carries the enrichment that makes it actionable: a CVSS severity vector, CWE weakness classifications, and CPE identifiers naming the affected products and version ranges. We cover how that data is structured in Understanding the NVD and CVSS.

The rate limits, with and without a key

The API is public, but throttled. The limits are the whole reason the key matters:

Access	Rate limit	Effective pace
No API key	5 requests / 30 seconds	~1 request every 6 seconds
With API key	50 requests / 30 seconds	~1 request every 0.6 seconds

Both limits are enforced over a rolling 30-second window, and each page of results counts as one request. Without a key, roughly one request every six seconds turns a sync of tens of thousands of CVEs into hours. The key is a tenfold increase, which is why NIST strongly recommends every automated consumer use one.

How to request a key

The whole process is free and self-service:

Go to the NVD developers page at nvd.nist.gov/developers/request-an-api-key.
Enter an email address and your organization name, and accept the terms of use.
NIST emails you a single-use activation link — open it to reveal your key.
The key is a UUID-format string. Store it somewhere secret, not in a repo.

Activation links expire, so if you wait too long you simply request another. One key per organization is the norm; you do not need a separate key per developer or per pipeline.

How to use it

The key goes in an HTTP header named apiKey — not a query parameter. A single-CVE lookup looks like this:

export NVD_API_KEY="your-uuid-key-here"

# Look up a single CVE
curl -s -H "apiKey: $NVD_API_KEY" \
  "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228" \
  | jq '.vulnerabilities[0].cve.id'

For bulk work, use pagination and incremental date filters instead of pulling everything every time. The API returns up to 2000 results per page; you page with startIndex and fetch only what changed with lastModStartDate and lastModEndDate:

# Fetch only CVEs modified in a date window, first page of 2000
curl -s -H "apiKey: $NVD_API_KEY" \
  "https://services.nvd.nist.gov/rest/json/cves/2.0?\
lastModStartDate=2026-07-01T00:00:00.000&\
lastModEndDate=2026-07-08T00:00:00.000&\
resultsPerPage=2000&startIndex=0"

# Then increment startIndex by 2000 for the next page,
# sleeping ~1s between requests to stay under the limit

Best practices

Keep it secret. Store the key in an environment variable or a secret manager and pass it at runtime. It is tied to your organization and should not sit in version control.
Still throttle yourself. A key raises the ceiling but does not remove it. Sleep briefly between requests; NIST recommends being conservative even with a key.
Sync incrementally. Pull the full dataset once, then use the last-modified date filters to fetch only changes. This is faster and far kinder to the API than re-downloading everything.
Handle 403 and 503 gracefully. If you exceed the limit or the service is busy, back off and retry rather than hammering. A rolling window means a short pause usually clears the throttle.

Why scanners need NVD data at all

NVD is one of the foundational enrichment sources in vulnerability scanning. Its CPE data is what lets a scanner decide programmatically whether your package at your version is affected by a given CVE, and its CVSS scores feed every severity gate and dashboard downstream. A scanner that wants fresh NVD data either queries the API live during a scan or synchronizes the dataset into a local database it can match against quickly — and both approaches run straight into the rate limit without a key.

NVD is not the only source, and it should not be the only one. Its 2024 enrichment slowdown — the subject of the NVD backlog explained — showed why relying on a single database is fragile. The strongest scanners combine NVD with OSV, GHSA, and vendor advisory feeds, which is the whole point of our CVE database comparison and the head-to-head in OSV vs NVD.

Where ScanRook fits

ScanRook uses NVD as one of several parallel sources, matching packages against OSV, NVD (via CPE matching), and Red Hat OVAL on every scan. Configuring an NVD API key raises the throughput of that NVD path and speeds the local vulnerability-database sync, so cold scans are no longer bottlenecked by the unauthenticated six-second pace. Because ScanRook never depends on NVD alone, a temporary NVD hiccup does not blind the scan — the other sources keep matching, and every finding is tagged with which source it came from.

Frequently asked questions

Is the NVD API key free?

Yes. NIST issues API keys at no cost through a short self-service request. There is no paid tier — the key exists to raise your rate limit, not to charge for access.

How long does approval take?

Usually minutes. You receive an activation email right after requesting, and clicking the link reveals the key immediately. If the link expires before you use it, just request another.

Do I put the key in the URL?

No. Send it in the apiKey request header. Putting credentials in a URL risks leaking them into logs and proxies, and the NVD API expects the header form.

Can multiple tools share one key?

They can, but the rate limit is per key, so several busy clients sharing one key will collectively hit the 50-per-30-seconds ceiling. Stagger their schedules or coordinate a single sync that other tools read from.

Scan with more than one source of truth

ScanRook matches every package against OSV, NVD, and Red Hat OVAL in parallel, so your findings never depend on a single database — and an NVD API key simply makes the NVD path faster. Every finding shows exactly which source it came from.

Start scanning Read the docs