Skip to main content

Get Your API Credentials

1

Sign up for Vouch

Create a free account at vouch.expert
2

Create a project

Projects help you organize different applications and environments
3

Get your API keys

Each project comes with 4 API keys:
  • Client Test - For development in the browser
  • Client Live - For production in the browser
  • Server Test - For development on the server
  • Server Live - For production on the server
Never use Server keys in client-side code - they can validate any email without domain restrictions!

Installation

Choose your platform:
npm install @vouch-in/js
# or for React
npm install @vouch-in/react
Mobile apps: The iOS and Android SDKs automatically send an Origin header as app://your.bundle.id. Add app://your.bundle.id (e.g., app://com.example.myapp) to your project’s allowed domains in the dashboard.

Basic Usage

import { Vouch } from '@vouch-in/js';

// Initialize with your client key
const vouch = new Vouch(
  'your-project-id',
  'your-client-api-key'
);

// Validate an email (includes automatic device fingerprinting)
const result = await vouch.validate('[email protected]');

// Check the recommendation
if (result.recommendation === 'allow') {
  console.log('Email is valid!');
} else {
  // Use the message field for a user-friendly error
  console.log(result.message); // e.g. "Please use a permanent email address, not a temporary one."
}

Understanding the Response

Every validation returns a response with:
{
  "checks": {
    "syntax": { "pass": true, "latency": 2 },
    "disposable": { "pass": true, "latency": 15 },
    "mx": { "pass": true, "latency": 45 }
  },
  "message": null,
  "metadata": {
    "fingerprintHash": "abc123...",
    "previousSignups": 0,
    "totalLatency": 182
  },
  "recommendation": "allow",
  "signals": ["new_device", "valid_email"]
}

Key Fields

  • recommendation - Overall recommendation: allow, block, or flag
  • message - Human-friendly error message when recommendation is flag or block (e.g. “Please use a permanent email address, not a temporary one.”). null when allow.
  • checks - Individual validation results (syntax, disposable, mx, etc.)
  • metadata - Device fingerprint and signup history
  • signals - Array of signal identifiers detected

Handling Results

Use the message field for quick user-facing errors, or check individual validations for custom logic:
const result = await vouch.validate(email);

// Option 1: Use the message field for a user-friendly error
if (result.recommendation === 'allow') {
  // Email is valid, proceed
} else {
  // Show the human-friendly error message
  console.log(result.message); // e.g. "Please use a permanent email address, not a temporary one."
}

// Option 2: Check individual validations for custom logic
const { checks, metadata } = result;

if (!checks.syntax?.pass) {
  // Invalid email format
}

if (!checks.disposable?.pass) {
  // Disposable email detected
}

if (metadata.previousSignups > 5) {
  // Multiple signups from this device
}

Client vs Server Keys

Client Keys

Use in browsers/mobile apps
  • Restricted to allowed domains
  • Lower rate limits (1,000/hour)
  • Safe to expose publicly
  • Includes device fingerprinting
  • Mobile apps: add app://your.bundle.id to allowed domains

Server Keys

Use on your backend
  • No domain restrictions
  • Higher rate limits (5,000/hour)
  • Must be kept secret
  • Can override IP/User-Agent
Server keys are blocked from browsers. If you try to use a server key in client-side code, you’ll get a 401 error.

Next Steps