API

Authentication

Send a key as a bearer token. Keys are scoped to your account and bounded by their spend cap; revoke one at any time from Settings.

Authorization: Bearer sbapi_your_key

Errors use { error, code } with a matching HTTP status: 401 unauthorized, 402 insufficient credits or spend cap, 429 rate limit or launch cooldown, 503 maintenance.

Launch an attack

POST /api/v1/attacks — body { targetEmail, emails } with emails between 100 and 1,000. One credit is charged per requested delivery.

curl -X POST https://strike2.pw/api/v1/attacks \
  -H "Authorization: Bearer sbapi_your_key" \
  -H "Content-Type: application/json" \
  -d '{"targetEmail":"[email protected]","emails":500}'

Returns { attack } with id, status, goal, delivered, blocked, failed and timestamps. The target is returned masked. Launches have a 2-second cooldown; keys are limited to 60 requests per minute.

Read an attack

GET /api/v1/attacks/{id} — poll while status is running or queued.

curl https://strike2.pw/api/v1/attacks/ATTACK_ID \
  -H "Authorization: Bearer sbapi_your_key"

Balance

GET /api/v1/balance returns { credits }.

curl https://strike2.pw/api/v1/balance \
  -H "Authorization: Bearer sbapi_your_key"

Webhooks

Add an endpoint in Settings → Webhooks. You receive a POST for attack.completed, attack.failed and invoice.paid, retried twice on 5xx and network errors. Redirects are not followed.

Headers: X-Strike-Event, X-Strike-Timestamp (unix seconds) and X-Strike-Signature. Verify the signature over timestamp.body before trusting the payload:

const crypto = require("node:crypto");

// headers: x-strike-signature = "sha256=<hex>", x-strike-timestamp = "<unix>"
const expected = "sha256=" + crypto
  .createHmac("sha256", process.env.STRIKE_WEBHOOK_SECRET)
  .update(headers["x-strike-timestamp"] + "." + rawBody)
  .digest("hex");

if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(headers["x-strike-signature"]))) {
  return response.status(401).end();
}