Mailboxlayer Authentication

generated: '2026-08-14'
method: searched
source: https://docs.apilayer.com/mailboxlayer/docs/getting-started
docs: https://docs.apilayer.com/mailboxlayer/docs/getting-started
sources:
  - https://docs.apilayer.com/mailboxlayer/docs/getting-started
  - openapi/_original/mailboxlayer-swaggerhub-openapi.json
  - openapi/mailboxlayer-verification-api-openapi.yml
description: >-
  Authentication profile for the mailboxlayer Verification API. Derived from the OpenAPI
  security schemes and upgraded to searched on 2026-08-14 against the provider's own
  "API Access Key & Authentication" documentation.

summary:
  types:
  - apiKey
  api_key_in:
  - query
  oauth2_flows: []
  openid_connect: false
  mutual_tls: false

schemes:
- name: AccessKeyQuery
  type: apiKey
  in: query
  parameter: access_key
  required: true
  description: >-
    Mailboxlayer API Access Key, required on every request to every operation. Issued at
    signup — one key per APILayer account, covering every APILayer product on that account.
  sources:
  - openapi/_original/mailboxlayer-swaggerhub-openapi.json
- name: AccessKeyAuth
  type: apiKey
  in: query
  parameter: access_key
  description: >-
    Same scheme under the name used in this repo's refined spec. AccessKeyQuery (the
    provider's own name) and AccessKeyAuth are the same credential.
  sources:
  - openapi/mailboxlayer-verification-api-openapi.yml

credential:
  issuance: >-
    Self-serve. Signing up at https://mailboxlayer.com/product or
    https://app.apilayer.com/signup assigns a personal API Access Key immediately; no
    credit card is required for the Free plan.
  dashboard: https://app.apilayer.com/
  scope: >-
    One account, one key, every APILayer API. The key is not scoped to mailboxlayer — it is
    the account credential across the whole APILayer marketplace, so its blast radius is the
    entire product portfolio the account subscribes to.
  rotation:
    documented: false
    note: No key-rotation procedure, expiry, or revocation policy is documented publicly.
  multiple_keys:
    supported: false
    note: >-
      No per-environment or per-application key issuance is documented. finops/ recommends
      one key per environment for cost allocation, but the provider does not document a
      mechanism for issuing more than one.

usage:
  example: 'https://apilayer.net/api/check?access_key=YOUR_ACCESS_KEY&email=support@apilayer.com'
  quote: >-
    "After signing up, every user is assigned a personal API Access Key — a unique
    'password' used to access the API's data and features. To authenticate with the
    Mailboxlayer API, simply attach your access_key to the base endpoint URL."
  transport:
    https: true
    note: >-
      256-bit HTTPS is listed as available on all plans including Free on both the pricing
      page and the Getting Started docs (checked 2026-08-14). Error 105
      (https_access_restricted) nonetheless remains in the published error catalog. The
      documentation's own worked examples still use http:// URLs.

hazards:
  - id: key-in-query-string
    severity: high
    description: >-
      The credential is a query parameter, so it is recorded wherever URLs are recorded:
      proxy and CDN logs, browser history, Referer headers, error trackers, and any agent
      trace that logs request URLs. There is no header-based alternative.
    mitigation: >-
      Call server-side, never from a browser with a production key, and redact `access_key`
      from every log sink and agent transcript.
  - id: no-scoping
    severity: medium
    description: >-
      A single key authorizes every APILayer product on the account. A leaked mailboxlayer
      key is a leaked marketstack / ipstack / scrapestack key.
  - id: auth-failure-returns-200
    severity: high
    description: >-
      Authentication failure has historically been returned with HTTP 200 and a
      `success:false` body (code 101). The current published spec also declares a real 401.
      Handle both — a 200 is not evidence the call was authorized.
    reference: errors/mailboxlayer-problem-types.yml
  - id: no-oauth-no-scopes
    severity: informational
    description: >-
      No OAuth 2.0, no OpenID Connect, no scopes, no token exchange. There is no
      delegation model, so an agent acting for a user necessarily holds the account's full
      credential. No scopes/ artifact is emitted — there is no scope surface to record.

related:
  conventions: conventions/mailboxlayer-conventions.yml
  errors: errors/mailboxlayer-problem-types.yml
  domain_security: security/mailboxlayer-domain-security.yml