Security Standard

Authentication & API Key Management

How to authenticate requests using secret API keys, manage key permissions, rotate credentials, and avoid exposing keys in frontend code.

AI & Discovery

Core Verification APIs

Advanced Intelligence

Webhooks & Automation

Reference & Status Codes

Client Libraries & SDKs

Every API request requires your secret API key passed via the X-API-Key header:

http

X-API-Key: bl_live_9a8b7c6d5e4f3a2b1c0d9e8f

BounceLayer also supports standard RFC 6750 Bearer authentication:

http

Authorization: Bearer bl_live_9a8b7c6d5e4f3a2b1c0d9e8f

Never Expose Keys in Client-Side Code: Never embed bl_live_... keys in frontend React, Vue, Next.js client bundles, or mobile applications. Always proxy verification requests through your backend API route.
Key Rotation: You can generate multiple API keys in your dashboard. When rotating credentials, create a new key, update your production environment variables, test connectivity, and then revoke the deprecated key.
Automated Scanners: If a secret key is accidentally committed to a public GitHub repository, our automated credential leak sentinel will automatically suspend the key and alert your account email.