Authentication

API keys, scopes, and rate-limit headers.

Every API request carries a key in the Authorization header. Keys start with mxp_live_ or mxp_test_ (the two are functionally identical; the prefix is a label for your own environments). Keys are hashed at rest and shown exactly once at creation.

header

Authorization: Bearer mxp_live_8Hj4K2pQwR9tYzN1mB7vX3cF6gL5sD0a

Scopes

verify:read — POST /v1/verify (fast mode)
bulk:write — POST /v1/verify/bulk and job polling (Starter and up)
usage:read — reserved for reading usage via the API
verify:deep — deep mode, when it ships

Rate limits and quota

Each plan has a per-minute request limit and a monthly credit quota. Responses carry X-RateLimit-Limit and X-RateLimit-Remaining; a 429 carries Retry-After. Fast mode costs 1 credit. Quotas reset on your billing period (paid) or the first of the month (free).

Idempotency

Send an Idempotency-Keyheader to make retries free: the same key with the same email within the month records one usage event. Without it, one is derived from your key, the email, and the mode, so a plain retry of the same request also isn't double-billed.

Request IDs

Every response carries X-Request-Id, and error bodies repeat it as error.request_id. Quote it when you contact support.