> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bouncedetector.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests using your API key as a Bearer token.

## Overview

All BounceDetector API endpoints that accept an API key require the **Bearer token** scheme: you send your API key in the `Authorization` header of every request.

## Sending your API key

Include the header:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

Replace `YOUR_API_KEY` with your full key (e.g. `bdt_abc123...`). The key is the value you received when you created the API key in the dashboard; do not add any prefix other than `Bearer `.

### Example with cURL

```bash theme={null}
curl -X POST "https://api.bouncedetector.com/api/v1/verify" \
  -H "Authorization: Bearer bdt_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com"}'
```

### Example with JavaScript (fetch)

```javascript theme={null}
const response = await fetch('https://api.bouncedetector.com/api/v1/verify', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.BOUNCEDETECTOR_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ email: 'user@example.com' }),
});
```

## Security

* **Keep your API key secret.** Do not expose it in frontend code, public repos, or logs.
* **Use environment variables or a secrets manager** in production.
* If a key is compromised, **revoke it** in the dashboard and create a new one.
* Keys are scoped to a **team**; usage and limits are applied per team.

## Error responses

| HTTP Status              | Meaning                                                      |
| ------------------------ | ------------------------------------------------------------ |
| **401 Unauthorized**     | Missing `Authorization` header, or invalid/revoked API key.  |
| **402 Payment Required** | Team has exceeded its plan limits (e.g. verification quota). |

When the key is missing or invalid, the response body will indicate that an API key is required or that the key is invalid.