.txt file, you can scan a .py file. The only difference is the file extension you send.
Teams use code scans to:
- Confirm that proprietary code has not appeared in public repositories, forums, or documentation sites.
- Check that contributed or outsourced code was not copied from other sources, to stay on the right side of licensing agreements.
- Review programming assignments for academic integrity.
Get started
1
Before you begin
Before you start, ensure you have the following:
- An active Copyleaks account. If you don’t have one, sign up for free.
- You can find your API key on the API Dashboard.
2
Installation
Choose your preferred method for making API calls.
HTTP needs no installation - call the API with any standard HTTP client, or import our Postman collection for a quicker start.
3
Login
To perform a scan, we first need to generate an access token. For that, we will use the login endpoint.
The API key can be found on the Copyleaks API Dashboard.Upon successful authentication, you will receive a token that must be attached to subsequent API calls via the
Authorization: Bearer <TOKEN> header.
This token remains valid for 48 hours.Response
Save this token. It is valid for 48 hours and can be reused for subsequent API calls.
4
Submit the code file for scanning
Use the Submit File Endpoint to send the file for analysis. The request is identical to a text submission: the file content goes in
base64, the file name goes in filename, and the scan settings go in properties. We suggest you provide a unique scanId for each submission, for example one derived from the file path.The extension in
filename tells Copyleaks how to read the file, so use the real extension of your source file (for example main.py, App.java, or server.js). Supported source code extensions:ts, py, go, cs, c, h, idc, cpp, hpp, c++, h++, cc, hh, java, js, swift, rb, pl, php, sh, m, scala, cssSource code files can be up to 3 MB each. See the full technical specifications for all input limits.What is Base64 Encoding?Base64 converts binary files into text strings so they can be sent via JSON. All programming languages have built-in Base64 encoding functions, see the code examples below for your language.
5
Wait for the completion webhook
The scan can take some time. Once it’s complete, Copyleaks sends a completed webhook to the status URL you provided. It contains a summary of the scan: an overall score, and one entry per source where the code was found, each with a An empty
result ID you will use in the next step.Matches are grouped by where they came from:results.internet- public web pages, including code hosting sites, forums, and documentation.results.database- documents in the Copyleaks Shared Data Hub.results.repositories- your own Private Cloud Hub repositories, if you scanned against any.
Completed webhook (trimmed)
results section with an aggregatedScore of 0 means none of the code was found in the sources you scanned against.6
Export detailed results
After the
completed webhook arrives, use the export endpoint to retrieve the detailed plagiarism results using the result IDs you received in the completion webhook. Each result contains the character positions of every matched range in your file and in the source, which you can map back to line numbers or feed into the Copyleaks report.We will also export the Crawled Version. The crawledVersion webhook contains the text version of the submitted file as Copyleaks processed it. This can later be used in order to display the report.In addition, you should also specify a completionWebhook to receive notifications when the export is ready.7
Summary
You have successfully submitted a source code file for plagiarism detection and exported the results. You can now handle the results in your application, highlight the matched lines for your users, or take further actions based on the findings.
Tune the scan for source code
The defaults work for most code scans. These settings are the ones teams most often adjust:- Where to look.
scanning.internet(on by default) covers public web sources. Addscanning.repositoriesto also compare against your own codebase in a Private Cloud Hub, which is how you check new code against everything your organization already indexed. - Keep proprietary code private. By default,
indexing.copyleaksDbisfalse, so your file is not added to the Shared Data Hub and other Copyleaks users can never match against it. Leave it that way for proprietary code. If you don’t want the file kept for comparison against your own future submissions either, setscanning.copyleaksDb.includeMySubmissionstofalse. - Cut down on noise. Source files share a lot of boilerplate, such as import blocks, license headers, and common idioms. Use
filters.minCopiedWordsto hide results below a minimum match size, andsensitivityLevel(1 is fastest, 5 is most thorough) to control how deep the scan goes. See Detection Levels for how identical, minor-change, and paraphrase matching can be toggled individually. - Ignore sources you own. If your own public sites show up as matches, exclude them with
filters.domainstogether withfilters.domainsModeset to1.
Frequently asked questions
Do I need a separate endpoint or plan to scan source code?
Do I need a separate endpoint or plan to scan source code?
No. Source code goes through the same Submit File endpoint as text and documents, uses the same properties, and is billed with the same plagiarism credits. The file extension in
filename is all that tells Copyleaks it is code.Which programming languages are supported?
Which programming languages are supported?
Files with these extensions are accepted:
ts, py, go, cs, c, h, idc, cpp, hpp, c++, h++, cc, hh, java, js, swift, rb, pl, php, sh, m, scala, css. The full list is in the technical specifications.Can I scan a whole repository at once?
Can I scan a whole repository at once?
Each submission is one file, and archives such as
.zip are not supported. To scan a repository, loop over the source files and submit each one with its own scanId. A path-based ID such as repo-src-utils-main-py makes it easy to map results back to files.Can I check code against my own private codebase?
Can I check code against my own private codebase?
Yes. Index your existing files into a Private Cloud Hub repository, then scan new files against it with
scanning.repositories. Matches from your repository come back in results.repositories in the completed webhook.Can I detect AI-generated code?
Can I detect AI-generated code?
No. AI Content Detection for source code was deprecated on December 16, 2025 and is no longer supported on the submit endpoints. Plagiarism detection for code is unaffected. See the release notes for details.
How are credits counted for code files?
How are credits counted for code files?
The same way as for text: every 250 words, or part of that, counts as one page. See technical specifications for the full breakdown.
Can I test code scanning without using credits?
Can I test code scanning without using credits?
Yes. Set
"sandbox": true in the submission properties. Sandbox mode is free and returns mock results, so you can wire up the flow before going live.Next steps
Webhooks Overview
Learn how to securely receive and process notifications from Copyleaks.
Viewing Scan Results
Understand the scan result format and how to display it to your users.
Data Hubs
Compare code against your own private repositories or the Shared Data Hub.
Submit File Reference
Every property you can set on a scan, with request and response examples.

