Bazarr's UI login and API key protect different automation paths

Bazarr manages subtitle search and synchronization for a media library. Its web UI and its REST API serve different clients, and the security review should treat them as separate surfaces. A login page can be configured correctly while an API key remains available to a script, dashboard or integration.

The Bazarr application settings documentation describes authentication and an API key for programmatic access. Bazarr also connects to Sonarr and Radarr using their API keys, as described in its library and connection documentation. Those keys represent different services and should not be treated as interchangeable.

Measurement evidence

On 2026-11-07 UTC, page-one count-only ZoomEye probes with sub_type=all returned 1,732 matches for app="Bazarr", 1,838 for title="Bazarr" and 35,605 for http.body="Bazarr". The close app and title counts make the product a useful inventory lead, but no count establishes whether authentication, TLS or API access is enabled.

Inventory the credential graph

Record the Bazarr base URL, UI authentication mode, API-key owner, connected Sonarr and Radarr endpoints, provider credentials, scheduled tasks and webhook receivers. Each connection is a trust edge. A compromised Bazarr service may be able to read media inventory and trigger subtitle searches through upstream APIs.

Scope keys to the smallest integration. Do not reuse a Sonarr or Radarr administrator API key for an unrelated dashboard. Protect local configuration and container environment files. If a reverse proxy provides authentication, verify that it also strips client-supplied identity headers and that direct access to Bazarr is blocked.

Test both interfaces

Test an unauthenticated browser request, the API with no key, the API with a valid key and the API with a revoked key. Confirm that changing the UI password does not silently invalidate automation or that key rotation does not leave an old webhook working. Review API error responses so they do not disclose filesystem paths or upstream credentials.

Webhook endpoints need their own authentication and replay handling. Bazarr's webhook documentation notes that current endpoints authenticate with Bazarr's API key rather than a signed request. If a receiver accepts an unsigned request, it needs a network boundary or an additional verification layer.

After an exposure, rotate the Bazarr key and any upstream service keys reachable from the host, review download-provider credentials and inspect recent synchronization activity. A media tool can look low impact until it becomes a pivot into storage and other automation services.

References

• Bazarr: application settings
• Bazarr: Sonarr and Radarr connections
• Bazarr: webhooks