Skip to main content

Get Your API Credentials

1

Sign up for Vouch

Create a free account at vouch.expert
2

Create a project

Projects help you organize different applications and environments
3

Get your API keys

Each project comes with 4 API keys:
  • Client Test - For development in the browser
  • Client Live - For production in the browser
  • Server Test - For development on the server
  • Server Live - For production on the server
Never use Server keys in client-side code - they can validate any email without domain restrictions!

Installation

Choose your platform:
npm install @vouch-in/js
# or for React
npm install @vouch-in/react

Basic Usage

import { Vouch } from '@vouch-in/js';

// Initialize with your client key
const vouch = new Vouch(
  'your-project-id',
  'your-client-api-key'
);

// Validate an email (includes automatic device fingerprinting)
const result = await vouch.validate('[email protected]');

// Check the recommendation
if (result.recommendation === 'allow') {
  console.log('Email is valid!');
} else {
  // Check specific validations
  const { checks, metadata } = result;

  if (!checks.syntax?.pass) {
    console.log('Invalid email format');
  } else if (!checks.disposable?.pass) {
    console.log('Disposable emails not allowed');
  }
}

Understanding the Response

Every validation returns a response with:
{
  "checks": {
    "syntax": { "pass": true, "latency": 2 },
    "disposable": { "pass": true, "latency": 15 },
    "mx": { "pass": true, "latency": 45 }
  },
  "metadata": {
    "fingerprintHash": "abc123...",
    "previousSignups": 0,
    "totalLatency": 182
  },
  "recommendation": "allow",
  "signals": ["new_device", "valid_email"]
}

Key Fields

  • recommendation - Overall recommendation: allow, block, or flag
  • checks - Individual validation results (syntax, disposable, mx, etc.)
  • metadata - Device fingerprint and signup history
  • signals - Array of signal identifiers detected

Handling Results

Check individual validations based on your requirements:
const result = await vouch.validate(email);

// Check overall recommendation
if (result.recommendation === 'allow') {
  // Email is valid, proceed
} else if (result.recommendation === 'flag') {
  // Flag for manual review
} else {
  // Block the signup
}

// Or check individual validations
const { checks, metadata } = result;

if (!checks.syntax?.pass) {
  // Invalid email format
}

if (!checks.disposable?.pass) {
  // Disposable email detected
}

if (metadata.previousSignups > 5) {
  // Multiple signups from this device
}

Client vs Server Keys

Client Keys

Use in browsers/mobile apps
  • Restricted to allowed domains
  • Lower rate limits (1,000/hour)
  • Safe to expose publicly
  • Includes device fingerprinting

Server Keys

Use on your backend
  • No domain restrictions
  • Higher rate limits (5,000/hour)
  • Must be kept secret
  • Can override IP/User-Agent
Server keys are blocked from browsers. If you try to use a server key in client-side code, you’ll get a 401 error.

Test vs Live Keys

Each environment has separate keys:
  • Test keys - Use during development, doesn’t count against quota
  • Live keys - Use in production, counts against your subscription

Next Steps