Emailsherlock
home/API/Quickstart/v1 Base · api.emailsherlock.com
Quickstart · v1

Your first check in five minutes.

Send one address. Get back whether it is deliverable, whether the domain has working mail, whether it is a disposable or role address, and a confidence score. Here is the whole path, from key to production, in five steps.

An emailsherlock account A terminal & curl or an SDK About 5 minutes
01Step

Get an API key

Sign in and create a key in your API keys settings. The key is shown once and cannot be recovered, so copy it straight away. There is no separate sandbox key: the free tier gives you 100 verifies a month against the live API.

Export it as an environment variable so it never touches your code. Every example below reads ES_KEY from the environment and sends it in the X-API-Key header.

Export your key
shell · ~/.zshrc
export ES_KEY="4f8c92a17b3d…"
! Never ship a key to the browser or commit it to git. A leaked key spends your credits. Keep it server-side and rotate it from the settings page if it is exposed.
02Step

Install the SDK

Pick your language. Each SDK is a thin wrapper over one HTTPS endpoint, all open source. If you would rather not add a dependency, curl works everywhere and needs nothing.

shell · npm
# node 18+ · ESM or CommonJS
npm install @emailsherlock/node
03Step

Run your first check

One address in, one result out, typically in under a second. The call on the right is complete and copy-paste ready. Swap the address for one of your own.

The body is a single field, email. The response is one result object with the verdict and every signal behind it. The same shape comes back from the batch endpoint, one per address.

Request
shell
curl https://api.emailsherlock.com/v1/verify/single \
  -H "X-API-Key: $ES_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'
Response200 OK
application/json
{
    "email": "[email protected]",
    "result": "valid",
    "mx": true,
    "disposable": false,
    "role": false,
    "catch_all": false,
    "score": 0.95,
    "freshness": "fresh"
}
04Step

Read the result

The result field is the verdict. The booleans and the score are the signals behind it, so you can branch on whichever matters to your flow.

emailstringrequired
The address you sent.
resultstringrequired
The verdict for this address. One of valid invalid catch_all disposable role unknown.
mxbooleanrequired
The domain has reachable MX records.
disposablebooleanrequired
Throwaway / temporary-mail provider.
rolebooleanrequired
Role address such as info@ or sales@.
catch_allbooleanrequired
Host accepts mail for any local part.
scorenumber · nullable
0-1 confidence, higher is safer to send to.
freshnessstringrequired
How recent the underlying data is. One of fresh cached_recent cached_stale_refreshed.
i Results are facts, not opinions. A role or catch_all address is not "bad". Whether it is safe enough to send to stays your call. Branch on result (stable enum) and score, and the X-Credits-Remaining header tells you what is left.
05Step

Move to production

Your first call already hit the live API, so there is no key or endpoint to swap. Four things separate a demo from a production integration.

Scrub lists with /v1/verify/batch
Send up to 100 addresses in one call instead of looping single checks. Same result object, one per address.
Watch your credits
Each verify costs 1 credit. Read X-Credits-Remaining on every response. Run out and you get a 402. A verify the engine can't complete is auto-refunded.
Back off on 429
Read the Retry-After header and wait that many seconds rather than a fixed sleep. Every response also carries X-RateLimit-Reset.
Keep the key server-side
Read it from an environment variable, as every example here does. A missing or invalid key returns 401.
Keep going

Where to next.

Reference Full API reference Every endpoint, parameter and result field, with live request and response samples in five languages. Endpoints Verify a whole batch Run up to 100 addresses through one call and scrub a list before you send to it. Plans Pricing & credits What each plan allows per minute and per month, and how credits are billed and roll over. Overview What the API does Validity, disposable and role detection, catch-all, MX and a confidence score, in one JSON object.
That's the whole API

One key. One request.