Authentication

Pass the key as a bearer token in the Authorization header. The x-api-key header is accepted as an alternative.

Authorization: Bearer vd_live_xxxxxxxxxxxxxxxxxxxxxxxx

The default. Full access to every endpoint. Use only in server-side code where the key is not exposed. Optionally pin a key to trusted IP addresses; requests from any other IP get 403 ip_not_allowed.

Safe to ship in a website's JavaScript. A public key can only call POST /v1/verify (single verification) and the endpoint answers CORS preflight. Pin it to allowed origins so only your site can use it; other origins get 403 origin_not_allowed. Calling any other endpoint returns 403 public_key_not_allowed.

const res = await fetch("https://new-project-rho-ecru.vercel.app/v1/verify", {
  method: "POST",
  headers: { Authorization: "Bearer vd_live_…public…", "Content-Type": "application/json" },
  body: JSON.stringify({ email: input.value }),
});
const { status, suggestion } = await res.json();
if (status === "invalid" || status === "disposable") showError(suggestion ? `Did you mean ${suggestion}?` : "Please check the address");

Limits are enforced per key and depend on your plan. See Errors & rate limits.