Authentication
Send your key in the Authorization header on every request:
Authorization: Bearer vc_live_3fA9…Keys belong to your team, not to a person, so they keep working when someone leaves. Create and revoke them on the API keys page of the dashboard.
Live and test keys
Section titled “Live and test keys”vc_live_… |
vc_test_… |
|
|---|---|---|
| Runs real checks | Yes | No, returns test answers |
| Uses credits | Yes | Never |
| Rate limit | Your plan’s | 10 requests a second |
| Needs a verified email | Yes | No |
Scopes
Section titled “Scopes”New keys get lookup, bulk, and account:read. A request that needs a scope the key doesn’t have returns 403 FORBIDDEN_SCOPE.
| Scope | Allows |
|---|---|
lookup |
Every POST /v1/… check |
bulk |
Bulk jobs (coming soon) |
account:read |
GET /v1/account |
Revoking a key
Section titled “Revoking a key”Revoking takes effect immediately: the next request with that key gets 401 UNAUTHORIZED. We only store a hash of each key, so a lost key can’t be recovered, only replaced.