# Endpoint & Authentication

The Leaked Cookies API has one `GET` endpoint. It authenticates with your API `token`.

## Search

`GET`

```bash
https://api.webz.io/cookies?token=YOUR_TOKEN&domain=example.com
```

Returns leaked cookies matched to `domain`, narrowed by your [Filters](leaked-cookies-filters).

## Authentication

- Pass `token` as a query parameter, or send an `Authorization: Bearer YOUR_TOKEN` header. A missing or unknown token returns `401`.
- Your account needs the Leaked Cookies API permission and credits. Otherwise requests return `401` or `429`.

> [!NOTE]
> Need access or more credits? Contact **sales@webz.io**.