Authentication

The VerifyEmail API uses API keys to authenticate requests. Pass your secret key as a Bearer token in the Authorization header.

Authorization: Bearer sk_your_api_key

cURL

curl https://api.tryverifyemail.com/v1/dmarc/domains \
  -H "Authorization: Bearer sk_your_api_key"

Node.js

const res = await fetch("https://api.tryverifyemail.com/v1/dmarc/domains", {
  headers: { Authorization: `Bearer ${process.env.VERIFYEMAIL_API_KEY}` },
});

Python

import os, requests

res = requests.get(
    "https://api.tryverifyemail.com/v1/dmarc/domains",
    headers={"Authorization": f"Bearer {os.environ['VERIFYEMAIL_API_KEY']}"},
)

Creating a key

Keys are managed from API Keys in the dashboard. Give the key a name you’ll recognise later — one key per service means you can rotate that service’s key without touching anything else.

The key is shown once

We store only a hash of your key, so we cannot show it to you again. Copy it when it’s created. If you lose it, revoke it and create another.

Revoking takes effect immediately — the next request made with that key gets a 401.

Key types

Key	Prefix	Where it’s used	Exposable?
Secret API key	sk_	Server-side API requests	No — keep it secret
Widget (publishable) key	pk_	Browser / the widget	Yes

Widget keys aren’t available yet

Only secret sk_ keys can be created today. Publishable pk_ keys ship with the widget — until then, never put a key in browser code.

What a key can do

A secret key acts for your account across the whole API — single verification, bulk jobs, and DMARC monitoring all accept the same key.

One thing it cannot do is manage keys. Creating and revoking keys requires signing in to the dashboard, so an attacker holding a leaked key cannot issue themselves a replacement before you turn the original off.

Keeping keys safe

• Never ship a secret key in client-side code, a mobile app, or a public repo.
• Store keys in environment variables or a secrets manager.
• Use separate keys per environment (e.g. test vs. production) and per service, so you can rotate or revoke independently.
• Rotate immediately if a key is exposed — create a new key, deploy it, then revoke the old one.

Errors

Status	Meaning
401	The key is missing, malformed, revoked, or not a key we issued.

A request that sends Authorization: Bearer sk_… is always authenticated as that key. If the key is invalid we return 401 rather than falling back to any session cookie that happened to ride along, so a broken key never silently acts as somebody else.