How to Search the Dark Web With an API

Manually browsing .onion sites through Tor Browser doesn't scale, and it doesn't automate. If you're a developer or analyst who needs dark web data inside a script, a product or a security pipeline, the answer is an API. Here's how it works — with real Python and curl examples.

Searching the dark web by hand is fine for a one-off look. But the moment you need to do it repeatedly — monitor a brand across thousands of .onion pages, enrich a threat feed, or ship dark web search inside your own app — clicking around in Tor Browser falls apart. You can't schedule it, you can't parse it, and you can't scale it.

A dark web search API solves exactly this. Instead of running Tor and crawling yourself, you send an HTTP request to a maintained index of .onion sites and get structured JSON back. This guide walks through how that works and how to make your first calls.

Why use an API instead of Tor Browser?

Three reasons developers and security teams reach for an API rather than manual browsing:

• Automation. An API call fits in a cron job, a webhook, a data pipeline. Manual browsing fits in none of them.
• No Tor to run. The index is already crawled over Tor; you query it over normal HTTPS. No Tor Browser, no crawler to maintain, no circuits to babysit.
• Lower operational risk. You never connect to a hidden service directly, so you're not exposing your machine to whatever lives on the other end of an unknown .onion address.

The trade-off: you're searching an index, not the live network in real time. For the overwhelming majority of use cases — monitoring, enrichment, research, product features — that's exactly what you want. (If you're new to how these indexes are built, our explainer on how dark web search engines work covers the crawling side.)

How it works, step by step

1. Get an API key

   Create an account and copy your key from the dashboard. The free Developer plan gives you 1,000 requests a month — enough to build and test — with no credit card.

2. Authenticate every request

   Pass your key in the X-API-Key header. That's the whole auth model — no OAuth dance, no tokens to refresh.

3. Send a search query

   A GET request to the search endpoint with your term in the q parameter. Add page for pagination.

4. Parse the JSON

   Read the results array — each entry has a title, .onion URL and snippet — plus a pagination object for paging through more.

Your first query with curl

The simplest possible call — search the .onion index for a keyword:

# Search the .onion index
curl -H "X-API-Key: sk-your_key_here" \
  "https://onionsearchengine.com/api.php?q=acme+leak"

The response comes back as JSON:

{
  "status": "success",
  "pagination": { "total_results": 150, "total_pages": 15 },
  "results": [
    {
      "title": "...",
      "url": "http://...onion",
      "context": "...matching snippet..."
    }
  ]
}

The same query in Python

A minimal Python example using requests — get results and loop through them:

import requests

API_KEY = "sk-your_key_here"
url = "https://onionsearchengine.com/api.php"

resp = requests.get(
    url,
    headers={"X-API-Key": API_KEY},
    params={"q": "acme leak", "page": 1},
)
data = resp.json()

for hit in data["results"]:
    print(hit["title"], "—", hit["url"])

That's the entire integration for basic search. From here it's just your normal code: store results, trigger alerts, feed another system.

Beyond search: the premium endpoints

Keyword search is the core, but most real workflows need more than a list of URLs. Four premium endpoints turn raw .onion data into structured intelligence, each called the same way (a GET with your X-API-Key):

For example, pulling extracted metadata for a specific site is a one-liner:

curl -H "X-API-Key: sk-your_key" \
  "https://onionsearchengine.com/api_metadata.php?url=example.onion"

The full parameter list, response schemas and examples for every endpoint live in the API documentation.

Common use cases

What people actually build on a dark web search API:

• Brand & credential monitoring — schedule searches for your domain or company name and alert when they surface on a new .onion page.
• Threat feed enrichment — add dark web context to indicators already flowing through your SIEM or SOAR.
• OSINT & investigations — query programmatically as part of a research pipeline, without manual Tor browsing.
• Product features — ship dark web search or monitoring inside your own security product, using the index as a data source.

If you'd rather not write code at all, the same index is available through a web dashboard with brand and keyword monitoring — useful for teams where not everyone is a developer.

A note on legality and good practice

Querying an index of public .onion sites is legal in most countries, the same as searching them by hand — liability comes from what you do with the data, not from the search. Because you never connect to hidden services directly, an API actually reduces your exposure compared with manual browsing. Standard good practice still applies: respect rate limits, don't build workflows around illegal content, and handle any sensitive data you retrieve (like leaked credentials you're monitoring for) responsibly.

Frequently asked questions