Help centre · Walkthrough

Install the CLI and run a scan

Here's how to install the Hardn command-line tool, and run your first scan from the terminal. (1:02)

Step by step

The same steps as the video.

1
Create an API key
In Hardn, open API keys and create a key. Copy it straight away, because it's only shown once, and keep it in your CI secrets.
API keys are under Configure → API keys. A key belongs to your organisation and uses its credits; revoke it there at any time.
2
Install the CLI
Install the command-line tool with pip. It needs Python 3.9 or newer, and nothing else.
Install
```
pip install hardn-cli        # or: pipx install hardn-clihardn --version
```
3
List your sites
Save your key in the HARDN_API_KEY variable, then run hardn targets to list your verified sites and their IDs.
Your sites
```
export HARDN_API_KEY=hk_live_…hardn targets
```
4
Run a scan
Run hardn scan with your site's ID. It waits for the result, and exits with an error if anything is at or above the severity you choose.
Scan
```
hardn scan --target tgt_… --fail-on highhardn scan --target tgt_… --sarif hardn.sarif   # also write a SARIF report
```
5
Read the result
When it finishes, you get the grade and every issue by severity. Exit code zero means nothing crossed your threshold.
Exit codes: 0 passed, 1 issues at or above --fail-on, 2 the scan didn't finish, timed out, or a usage or API error. Use --format json for machine-readable output.

“Provide a valid API key as a Bearer token.”

HARDN_API_KEY is missing, mistyped or revoked. Create a new key on the API keys page.

The scan is refused for my site.

Hardn only scans sites whose ownership is verified. Open the site in Hardn and check its ownership again.

It exits with 2.

The scan failed, timed out (raise --timeout, default 900 seconds) or the API answered with an error; the message says which.

Still stuck? Email support@hardn.si and a person will reply.