How do I authenticate Valid Email Checker API requests?

Every request to the Valid Email Checker API needs to carry your API key in an Authorization header, formatted as a Bearer token. There is no query-string auth, no separate X-API-Key header, no cookie-based session — just the standard Authorization: Bearer <key> shape that most APIs use. Keep that header on every call, including bulk task creation and result polling.

The exact header format

Authorization: Bearer VECabcdefghjk23mnpqrstuvwxyz234567

Notes on each part:

• Authorization — capital A, the standard HTTP header name. Case-insensitive per the spec but most languages preserve the capital.
• Bearer — capital B, then a single space. The space is required; Bearer VEC... with two spaces is malformed.
• VEC... — the full 35-character key from your Developer page. No quotes, no surrounding angle brackets, no trailing whitespace.

Examples per language

# cURL
curl -X POST https://app.validemailchecker.com/api/verify-single \
  -H "Authorization: Bearer $VEC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "test@example.com"}'

// Node.js (built-in fetch)
const response = await fetch(
  'https://app.validemailchecker.com/api/verify-single',
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.VEC_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ email: 'test@example.com' }),
  }
);

# Python (requests)
import os, requests

response = requests.post(
    'https://app.validemailchecker.com/api/verify-single',
    headers={
        'Authorization': f"Bearer {os.environ['VEC_API_KEY']}",
        'Content-Type': 'application/json',
    },
    json={'email': 'test@example.com'},
)

What goes wrong (and how the API tells you)

Repeated authentication failures from the same IP trigger our abuse-protection circuit breaker. After several invalid-key attempts in a short window, that IP gets temporarily blocked — see API rate limits and error handling for the threshold. Always validate the key format client-side before sending; see the regex in how does the API key prefix identify our keys.

Store the key securely

No key rotation header

Some APIs let you pass two keys during rotation (the old one and the new one) so requests do not fail mid-deploy. Valid Email Checker does not — it accepts one Bearer token per request. The recommended rotation pattern is to issue the new key, deploy it to your application, verify it works, then revoke the old key. See what happens to in-flight verifications when a key is revoked for the safe ordering.

Next steps