Zerobounce Authentication

generated: '2026-08-13'
method: searched
source: https://www.zerobounce.net/docs/api-dashboard
docs: https://www.zerobounce.net/docs/email-validation-api-quickstart
summary: >-
  ZeroBounce v2 uses a single account-level API key passed as a plain request parameter.
  There is no OAuth, no OpenID Connect, no scopes, no bearer-token header, and no mutual
  TLS. One key carries full authority over the account, including spending validation
  credits, so an agent handed this key can incur cost without further constraint.
schemes:
  - id: api_key_query
    type: apiKey
    in: query
    name: api_key
    description: >-
      Every GET operation on api-us / api-eu / api.zerobounce.net /v2 and on
      bulkapi.zerobounce.net takes `api_key` as a query-string parameter, e.g.
      GET /v2/validate?api_key=<key>&email=<address>.
    applies_to:
      - 'GET /v2/validate'
      - 'GET /v2/getcredits'
      - 'GET /v2/getapiusage'
      - 'GET /v2/scoring'
      - 'GET /v2/activity'
      - 'GET /v2/guessformat'
      - 'GET bulkapi.zerobounce.net/v2/filestatus'
      - 'GET bulkapi.zerobounce.net/v2/getfile'
      - 'GET bulkapi.zerobounce.net/v2/deletefile'
      - 'GET bulkapi.zerobounce.net/v2/scoring/*'
      - 'GET bulkapi.zerobounce.net/listS3files'
    evidence: collections/zerobounce-api-v2-official.postman_collection.json
  - id: api_key_body
    type: apiKey
    in: body
    name: api_key
    description: >-
      POST operations carry `api_key` in the JSON body (validatebatch, filters/add,
      filters/delete) or as a multipart form field (sendfile, scoring/sendfile,
      validateS3file, scoreS3file, exportS3file).
    applies_to:
      - 'POST /v2/validatebatch'
      - 'POST /v2/filters/add'
      - 'POST /v2/filters/delete'
      - 'POST bulkapi.zerobounce.net/v2/sendfile'
      - 'POST bulkapi.zerobounce.net/v2/scoring/sendfile'
    evidence: collections/zerobounce-api-v2-official.postman_collection.json
  - id: api_key_optional_plugin
    type: apiKey
    in: body
    name: api_key
    optional: true
    description: >-
      The ChatGPT-plugin endpoints on members-api.zerobounce.net accept an OPTIONAL
      api_key: an unauthenticated caller gets up to 3 single-validation requests per day.
      Batch validation on that host requires a key.
    applies_to:
      - validate
      - validateBatch
    evidence: openapi/zerobounce-validation-api-openapi.yml

key_management:
  created_in: ZeroBounce member dashboard (API / Developer section)
  docs: https://www.zerobounce.net/docs/api-dashboard
  signup: https://www.zerobounce.net/members/createaccount
  rotation: >-
    ZeroBounce documents an "API Keys Management" section in the dashboard docs; key
    rotation is performed from the dashboard. The provider's own MCP README advises using
    separate keys per environment and rotating them periodically, which implies multiple
    keys per account are supported.
  scopes: none
  expiry: none documented

transport:
  https_required: true
  tls_support_page: https://www.zerobounce.net/docs/api-dashboard/tls-support
  regions:
    - host: https://api-us.zerobounce.net
      residency: United States only
    - host: https://api-eu.zerobounce.net
      residency: European Union only
    - host: https://api.zerobounce.net
      residency: >-
        Legacy endpoint; per ZeroBounce's own endpoints page it now serves EU validations
        and interactions only.

risks:
  - >-
    The key travels in the query string on the majority of operations, so it lands in
    proxy logs, browser history and referrer headers. Any integration that logs full URLs
    is logging the credential.
  - >-
    No scopes means read-only agent use (get_credits, get_api_usage) cannot be separated
    from spend-incurring use (validate, sendfile, scoring).
  - >-
    ZeroBounce applies a punitive auth-failure policy rather than a scoped one: 200 bad
    API key requests in 1 hour triggers a 1-hour to 1-day block on the whole account key.

not_present:
  oauth2: false
  openid_connect: false
  mutual_tls: false
  http_bearer: false
  jwt: false
  webhook_signing: >-
    ZeroBounce POSTs bulk-completion callbacks to a caller-supplied return_url but
    documents no signature, shared secret or verification header on that request. See
    asyncapi/zerobounce-webhooks.yml.