Clearbit Authentication: API Key Setup and Security (2026)

Authentication overview

Clearbit's API utilizes a straightforward authentication model, relying on API keys to secure access to its various data enrichment and identification services. This approach is common for RESTful APIs that provide data access rather than user-specific actions. Each API key is a unique token that identifies your account and authorizes your application to make requests against the Clearbit API. Proper handling and protection of these keys are crucial for maintaining the security and integrity of data access.

The Clearbit API is organized around REST principles, accepting and returning JSON. All API requests must be made over HTTPS to ensure encrypted communication. Authentication is handled by including your secret API key with each request, which allows Clearbit to verify your identity and track your usage against your account's rate limits and subscription plan. Clearbit provides SDKs for several programming languages, including JavaScript, Ruby, Python, Node.js, and Go, which abstract away the direct handling of authentication headers or parameters, simplifying integration.

Supported authentication methods

Clearbit primarily supports API key authentication. This method is suitable for server-to-server communication and backend applications where the API key can be securely stored and managed. The API key acts as a secret token, granting access to your account's resources.

The following table summarizes the primary authentication method for Clearbit:

API keys are typically passed in one of two ways within an HTTP request:

• Query Parameter: As a key parameter in the URL (e.g., https://person.clearbit.com/v2/combined/[email protected]&key=YOUR_API_KEY).
• HTTP Header: As an Authorization header with a Bearer token (e.g., Authorization: Bearer YOUR_API_KEY) or a custom header like X-Clearbit-Key. Clearbit's documentation suggests passing the key as a query parameter or using the key parameter in the request body for POST requests, but standard practice for secret keys often includes the Authorization header for better security posture, especially when dealing with proxies or logs that might capture URLs.

Getting your credentials

To obtain your Clearbit API key, follow these steps:

1. Sign Up/Log In: Navigate to the Clearbit website and either sign up for a new account or log into your existing one. Clearbit offers a Growth plan starting at $99/month, which includes API access.
2. Access Dashboard: Once logged in, go to your Clearbit dashboard.
3. Locate API Keys: Look for a section related to 'API Keys', 'Account Settings', or 'Developers'. The exact path may vary but is typically found under your profile or account management settings.
4. Generate/Retrieve Key: Your secret API key will be displayed. If one isn't automatically generated, there may be an option to generate a new key. Treat this key as a sensitive secret.
5. Copy Key: Copy the API key to a secure location. It is recommended to store it in environment variables or a secure configuration management system rather than hardcoding it directly into your application code.

Clearbit's API documentation provides detailed instructions on where to find and manage your API keys within their platform.

Authenticated request example

Here's an example of an authenticated request using the Clearbit Person API to enrich an email address. This example demonstrates passing the API key as a query parameter, which is a common method documented by Clearbit.

cURL example

curl "https://person.clearbit.com/v2/combined/[email protected]&key=YOUR_API_KEY"

Replace YOUR_API_KEY with the actual API key you obtained from your Clearbit dashboard. The email parameter specifies the email address to be enriched.

Node.js example (using Clearbit's official Node.js library)

Using the official SDK simplifies the authentication process:

const clearbit = require('clearbit')('YOUR_API_KEY');

async function enrichPerson(email) {
  try {
    const person = await clearbit.person.find({
      email: email,
      stream: true
    });
    console.log(person);
  } catch (err) {
    if (err.type === 'email_not_found') {
      console.log('Email not found');
    } else {
      console.error('Error:', err);
    }
  }
}

enrichPerson('[email protected]');

In this Node.js example, the API key is passed once during the initialization of the clearbit object. The library then automatically handles including the key in subsequent API calls. This is generally the recommended approach when an official SDK is available.

Security best practices

Securing your Clearbit API keys is essential to prevent unauthorized access to your account and data. Adhere to these best practices:

• Keep API Keys Secret: Never expose your API keys in client-side code (e.g., JavaScript in a web browser) or embed them directly into public repositories. Treat them like passwords.
• Use Environment Variables: Store API keys in environment variables (e.g., CLEARBIT_API_KEY) on your server or development machine. This prevents them from being committed into source control.
• Restrict Access: Limit who has access to your API keys within your organization. Only provide access to developers and systems that explicitly require it.
• Rotate Keys Regularly: Periodically generate new API keys and revoke old ones. This minimizes the risk associated with a compromised key. Clearbit's dashboard should provide functionality for key rotation.
• Use HTTPS: All communication with the Clearbit API must occur over HTTPS. This encrypts the data in transit, including your API key, protecting it from eavesdropping. The use of HTTPS is a fundamental security requirement for any API interaction, as outlined by web security standards from organizations such as the World Wide Web Consortium (W3C).
• Implement Least Privilege: If Clearbit offered different types of API keys with varying permissions (though currently, it primarily uses a single key for full access), you would use keys with the minimum necessary permissions for each application.
• Monitor API Usage: Regularly check your Clearbit API usage metrics in your dashboard. Unusual spikes in activity could indicate unauthorized use of your API key.
• Secure Development Practices: Follow general secure coding guidelines to prevent vulnerabilities like injection attacks or insecure deserialization that could expose sensitive information, including API keys.
• Avoid Hardcoding: Do not hardcode API keys directly into your application code. Instead, load them dynamically from configuration files, environment variables, or a secrets management service.