About Multiple API Keys

[Bundy01]

Hi,

Several API keys can be added to the configuration file for the same source.

I would like to know how these keys are managed.

• Randomly
• First key until the quota is exhausted, then the second key is queried...
• One request is used on all added keys
• Other

Regards.

[bad-antics]

When you add multiple API keys for the same source in subfinder, they are used round-robin style (rotating through them).

For example:

virustotal:
  - key1
  - key2
  - key3

Subfinder will:

1. Use key1 for the first request
2. Use key2 for the second request
3. Use key3 for the third request
4. Back to key1, etc.

This helps with:

• Distributing rate limits across multiple keys
• Avoiding quota exhaustion on a single key
• Higher throughput for sources with strict per-key limits

It does NOT:

• Wait for one key to be exhausted before using the next
• Make parallel requests with all keys simultaneously

For maximum benefit, use keys from different accounts/subscriptions if the source allows it.

[bad-antics]

Multiple API keys for the same source are used sequentially with automatic rotation.

The behavior:

1. First key is used until it hits rate limits or quota exhaustion
2. Automatically switches to next key when the current one fails
3. Round-robin style - cycles through all keys

Example config:

virustotal:
  - key1_here
  - key2_here
  - key3_here

This is useful for:

• Bypassing rate limits (spread requests across keys)
• Higher quotas (combined quota of all keys)
• Redundancy (if one key expires/revoked)

Note: Its NOT parallel - doesnt query all keys simultaneously for the same request. Its sequential with failover.

For sources with strict rate limits (like SecurityTrails), having 3-4 keys effectively multiplies your allowed requests.

[bad-antics]

Subfinder handles multiple API keys with a round-robin rotation strategy.

When you add multiple keys for the same source in ~/.config/subfinder/provider-config.yaml:

shodan:
  - key1
  - key2
  - key3
virustotal:
  - vtkey1
  - vtkey2

How it works:

1. Keys are rotated sequentially (round-robin), not randomly
2. When one key hits its rate limit or quota, subfinder automatically moves to the next key
3. This effectively multiplies your quota — 3 keys = ~3x the requests before exhaustion
4. If ALL keys for a source are exhausted, that source is skipped

Key points:

• The rotation happens per-source, not globally
• There's no parallel usage of multiple keys simultaneously
• Keys are cycled in the order they appear in the config file
• Rate limit errors (HTTP 429) trigger the rotation to the next key

Best practice: Add keys in order of highest quota first, so subfinder uses your best keys before falling back to others.

This is the same pattern used by other ProjectDiscovery tools like uncover and chaos.

[bad-antics]

Subfinder handles multiple API keys with a round-robin rotation strategy.

When you add multiple keys for the same source in ~/.config/subfinder/provider-config.yaml:

shodan:
  - key1
  - key2
  - key3
virustotal:
  - vtkey1
  - vtkey2

How it works:

1. Keys are rotated sequentially (round-robin), not randomly
2. When one key hits its rate limit or quota, subfinder automatically moves to the next key
3. This effectively multiplies your quota — 3 keys = ~3x the requests before exhaustion
4. If ALL keys for a source are exhausted, that source is skipped

Key points:

• The rotation happens per-source, not globally
• There's no parallel usage of multiple keys simultaneously
• Keys are cycled in the order they appear in the config file
• Rate limit errors (HTTP 429) trigger the rotation to the next key

Best practice: Add keys in order of highest quota first, so subfinder uses your best keys before falling back to others.

This is the same pattern used by other ProjectDiscovery tools like uncover and chaos.

[bad-antics]

Subfinder handles multiple API keys with a round-robin rotation strategy.

When you add multiple keys for the same source in ~/.config/subfinder/provider-config.yaml:

shodan:
  - key1
  - key2
  - key3
virustotal:
  - vtkey1
  - vtkey2

How it works:

1. Keys are rotated sequentially (round-robin), not randomly
2. When one key hits its rate limit or quota, subfinder automatically moves to the next key
3. This effectively multiplies your quota — 3 keys = ~3x the requests before exhaustion
4. If ALL keys for a source are exhausted, that source is skipped

Key points:

• The rotation happens per-source, not globally
• There is no parallel usage of multiple keys simultaneously
• Keys are cycled in the order they appear in the config file
• Rate limit errors (HTTP 429) trigger the rotation to the next key

Best practice: Add keys in order of highest quota first, so subfinder uses your best keys before falling back to others.

This is the same pattern used by other ProjectDiscovery tools like uncover and chaos.