Verify emails and phones in real time, from your code
A simple REST API to verify an email or phone the moment it's captured — so bad data never enters your database in the first place. Available on the Business plan.
Verify at the point of capture
The cleanest data is data you never let in. Call the API the moment someone submits a form or signs up, and get back a status in real time — so you can block invalid addresses, disposable domains and risky numbers before they ever become a record.
This flips the usual order of operations. Instead of letting bad data accumulate and cleaning it up later in a bulk pass, you stop it at the door. Over time that's the difference between a database that slowly decays and one that stays clean by construction.
What you get back
Email and phone in a single call
The same endpoint that verifies an email can validate a phone number, so a signup form that captures both can check both in one round-trip. For products that gate on a real phone number — SMS verification, dialer lists, two-factor flows — that means catching a VoIP or disconnected number at the same moment you catch a bad email.
Bundling the two in one API keeps your validation logic simple: one integration, one response shape, one place to reason about whether a contact is real and reachable across channels.
Simple to integrate
Authenticate with a bearer key, POST a JSON body, read the result — there's no SDK to learn or heavy setup to do. Most teams have a working integration in an afternoon and wire it into the form submission flow they already have.
Because the response is plain JSON with clear statuses, it's straightforward to act on: reject outright on invalid, surface a typo suggestion, flag catch-all for review, or let valid through untouched.
Common use cases
Real-time verification shows up wherever bad data would otherwise enter your systems.
Built on the same engine as bulk
The API runs the same verification engine as bulk list cleaning, so a result is consistent no matter how you got it. An address marked valid by a real-time API call means exactly what it means when the same address appears in a bulk-cleaned file.
That consistency matters when you use both — gating forms in real time and periodically bulk-cleaning the database behind them. There's one source of truth for what 'verified' means, rather than two tools that might disagree.
Reliability and rate limits
The API is rate-limited to protect reliability, with limits set generously for normal real-time form and signup use — high enough that a busy signup flow won't hit them in ordinary operation. If you need to check a large backlog, that's what bulk verification is for; the API is tuned for live, per-record checks.
Keys are managed from your settings, where you can generate and revoke them, so you stay in control of what's calling the service.
Designing a good form-validation experience
A verification API is only as good as the experience you build around it, and the goal is to catch bad data without frustrating real users. The most effective pattern is gentle: when the API flags a likely typo, surface the suggestion inline — 'did you mean name@gmail.com?' — and let the person fix it in one tap rather than blocking them with an error.
Reserve hard blocks for the cases you're confident about: clearly invalid syntax, dead domains, and known disposable providers. For ambiguous results like catch-all, it's usually better to accept the signup and flag the record internally than to risk turning away a real customer at a corporate domain. The aim is to keep your data clean while keeping your conversion rate intact — the two don't have to be in tension.
Done well, the user barely notices the check is happening. They get a small nudge when they fat-finger their address, and you quietly keep fakes and typos out of your database.
Keeping your database clean over time
Real-time verification at the point of capture is the front door, but it works best as one half of a two-part strategy. The API keeps new data clean as it enters; periodic bulk verification removes the decay that accumulates in records you already hold, since even a perfectly verified address can go stale as the person changes jobs.
Using both means your database trends toward clean rather than slowly degrading. New signups are vetted on the way in, and your existing records are refreshed on a schedule — so you're never in the position of discovering, mid-campaign, that a large chunk of your list quietly died since you last checked.
Because the API and bulk verification share one engine, the two stay consistent: a record gated as valid at signup means the same thing as a record cleaned in a later bulk pass, with no contradictory verdicts to reconcile.
Security and key management
API access is controlled with bearer keys you generate and revoke from your settings, so you decide exactly what can call the service and can cut off a key instantly if it's ever exposed. That control matters when verification is wired into production form flows that handle real user data.
On the data side, the same privacy posture that applies across BounceBlock applies here: the addresses you check aren't sold or shared, and uploaded data is encrypted and deleted within 24 hours. Verifying at the point of capture means you're often checking an address without ever needing to store it, which is the cleanest possible position from a data-minimisation standpoint.
Real-time verification and your conversion rate
The fear with any signup-form check is that it costs you real conversions, and that's a fair concern worth designing around. The trick is to match how hard you push back to how confident the result is. A clear, unambiguous failure — invalid syntax or a dead domain — can be blocked outright, because a user who can't be reached isn't a conversion you'd have kept anyway. A typo suggestion should be offered gently, since most people will happily correct 'gmial.com' if you point it out.
The ambiguous middle — catch-all and unknown results — is where heavy-handed blocking actually hurts. Turning those away risks rejecting real customers at corporate domains, so it's usually smarter to accept the signup and flag the record for review. Used this way, verification improves data quality without denting your conversion rate; the two goals align rather than compete, because the only signups you turn away are the ones that could never have become customers.
Integrating with your existing stack
Because the API is a plain REST endpoint with a simple JSON contract, it drops into whatever you've already built rather than forcing you to adopt a new framework. Teams wire it into custom signup forms, server-side validation on lead-capture endpoints, and the points where data flows in from ads, landing pages and partner feeds.
It also pairs naturally with automation platforms and the glue code teams already run between their tools — a verification step added to the moment a new lead is created, so nothing reaches the CRM unchecked. The lightweight integration is deliberate: the goal is to make verifying at the point of capture so easy that there's no reason not to do it everywhere data enters your systems.
When to use the API versus bulk verification
The two products solve different shapes of the same problem, and knowing which to reach for keeps things efficient. The API is built for live, per-record checks at the moment data is captured — a signup, a form submission, a single lookup — where a fast answer in the flow is what matters. Bulk verification is built for cleaning lists you already hold, where you want to process thousands of rows at once and download an annotated file.
Most mature setups use both: the API as the front door that keeps new data clean, and bulk verification as the periodic deep clean that removes the decay accumulating in existing records. Trying to clean a large backlog through per-record API calls is the wrong tool for the job — that's what bulk is for — just as running a single signup check through a bulk upload would be needlessly slow. Match the tool to the moment and each does what it's best at.
Ready to see what’s hiding in your list?
Upload a file and preview your first 100 verifications free — email and phone, in one pass.
Frequently asked
Which plan includes the API?
The Business plan includes API access and key management. You can generate and revoke keys from your settings at any time.
How do I authenticate and call it?
Authenticate with a bearer key in the request header, then POST a JSON body with the email or phone to check. The response is plain JSON with a clear status, sub-status and any typo suggestion — no SDK required.
Can I verify phone numbers through the API too?
Yes — the same endpoint validates phone numbers, returning validity, line type and carrier. A form that captures both an email and a phone can check both in a single call.
Is the API rate-limited?
Yes, to protect reliability — limits are generous for normal real-time form and signup use. For large backlogs, bulk verification is the better fit; the API is tuned for live, per-record checks.
How fast is the response?
Fast enough to validate inline as a user submits a form, so it doesn't get in the way of the signup experience. It's designed for real-time use at the point of capture.
Is my data safe?
Your uploaded data is encrypted and permanently deleted within 24 hours. We never sell or share it, and we're built to be GDPR-friendly.
Stop wasting hours on dead leads.
Upload your list and see how clean it really is — free, in under two minutes.