API Authentication

The Meirra API uses API key authentication. Every request must include a valid API key in the request header. Keys are scoped to your account and can be created, managed, and revoked from the Developer Dashboard.

API keys are unique identifiers that authenticate your requests. You can create multiple keys for different environments or applications: • **Production keys** start with `mk_live_` and access real data with real costs • **Test keys** start with `mk_test_` and use sandbox data without charges Each key has a name for identification and tracks its own usage statistics. Never share your API keys publicly or commit them to version control.

Include your API key in the `x-api-key` header with every request: ```bash curl -X POST https://api.meirra.com/v1/email/verify \ -H "x-api-key: mk_live_your_key_here" \ -H "Content-Type: application/json" \ -d '{"email": "test@example.com"}' ``` Requests without a valid API key will receive a 401 Unauthorized response.

For additional security, you can restrict API key usage to specific IP addresses. When an IP allowlist is configured, requests from other IPs will be rejected with a 403 Forbidden response. To configure an allowlist: 1. Go to Developer Dashboard → API Keys 2. Click the settings icon on your key 3. Add allowed IP addresses (supports CIDR notation) Leave the allowlist empty to allow requests from any IP.

Regularly rotating your API keys is a security best practice. To rotate a key: 1. Create a new API key with the same permissions 2. Update your application to use the new key 3. Verify the new key works correctly 4. Revoke the old key from the Developer Dashboard Revoked keys cannot be restored, so ensure your applications are updated before revoking.

Follow these guidelines to keep your API integration secure: • **Never expose keys in client-side code** - API keys should only be used server-side • **Use environment variables** - Store keys in env vars, not in code • **Use separate keys per environment** - Don't use the same key for dev and production • **Enable IP allowlists for production** - Restrict keys to known server IPs • **Monitor usage regularly** - Watch for unexpected spikes that could indicate compromise • **Rotate keys periodically** - Change keys every 90 days as a precaution • **Revoke unused keys** - Remove keys that are no longer needed