Disify Authentication: API Key Setup and Security (2026)

Authentication overview

Disify provides an API for real-time email validation and disposable email detection. Access to the Disify API is secured through the use of API keys. These keys serve as a unique identifier for your application and authorize your requests against the API, linking them to your account and usage limits. All communication with the Disify API, including the transmission of API keys, is conducted over HTTPS to ensure data encryption and integrity during transit, a standard practice for web-based APIs to protect sensitive information from interception.

The API key model simplifies integration for developers, as it generally requires including a single token in each API request. This method is common across many web services for its ease of implementation and management for both the API provider and consumer. For example, similar API key authentication schemes are employed by services like SparkPost for email sending and Twilio for communication APIs, demonstrating its widespread adoption for securing access to specific API endpoints without requiring complex token exchange flows. While convenient, proper handling and security measures for API keys are crucial to prevent unauthorized access.

Supported authentication methods

Disify exclusively supports API key authentication for accessing its services. This method involves generating a unique alphanumeric string from your Disify account dashboard and including it in every API request.

The following table outlines the details of Disify's authentication method:

API keys are typically transmitted as a query parameter in the API request URL. This approach is straightforward but necessitates strict adherence to HTTPS to encrypt the key during transit. Without HTTPS, the API key could be vulnerable to interception, potentially leading to unauthorized usage of your Disify account and its associated request quotas.

Getting your credentials

To begin using the Disify API, you must first obtain an API key from your Disify account dashboard. This key is your primary credential for authenticating all requests.

1. Create a Disify Account: If you do not already have an account, navigate to the Disify homepage and complete the registration process. A free tier is available, which includes 1,000 requests per month, allowing you to test the API without immediate cost.
2. Log In: Once registered, log in to your Disify account.
3. Access API Key Section: Within your dashboard, locate the section dedicated to API keys or developer settings. The exact navigation may vary, but it is typically found under 'Settings', 'API', or 'Developer Resources'. Consult the Disify API documentation for precise instructions on locating your key.
4. Generate/Retrieve API Key: Your API key should be displayed there. If you are setting up for the first time, you might need to click a 'Generate API Key' button. Copy this key carefully. It is a long alphanumeric string.

It is critical to treat your API key as a sensitive password. Do not hardcode it directly into client-side code, commit it to version control systems like Git, or expose it in public repositories. If your API key is compromised, it could lead to unauthorized use of your Disify account, potentially incurring unexpected charges or exceeding your rate limits. If you suspect your key has been compromised, you should immediately generate a new key from your Disify dashboard and revoke the old one.

Authenticated request example

Once you have obtained your API key, you can integrate it into your API requests. The Disify API expects the API key to be passed as a query parameter named apiKey. Below are examples demonstrating how to make an authenticated request using cURL and Node.js, targeting the email validation endpoint.

cURL Example

This cURL command validates the email address [email protected] using your API key.

curl "https://api.disify.com/[email protected]&apiKey=YOUR_API_KEY"

Replace YOUR_API_KEY with the actual API key from your Disify dashboard.

Node.js Example

This Node.js example uses the node-fetch library to make an authenticated request.

const fetch = require('node-fetch');

const apiKey = 'YOUR_API_KEY'; // Replace with your actual API key
const emailToValidate = '[email protected]';

async function validateEmail() {
  try {
    const response = await fetch(`https://api.disify.com/?email=${emailToValidate}&apiKey=${apiKey}`);
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    const data = await response.json();
    console.log('Validation Result:', data);
  } catch (error) {
    console.error('Error validating email:', error);
  }
}

validateEmail();

Remember to install node-fetch if you haven't already: npm install node-fetch.

Python Example

This Python example uses the requests library to perform an authenticated email validation.

import requests

api_key = 'YOUR_API_KEY'  # Replace with your actual API key
email_to_validate = '[email protected]'

url = f"https://api.disify.com/?email={email_to_validate}&apiKey={api_key}"

try:
    response = requests.get(url)
    response.raise_for_status()  # Raise HTTPError for bad responses (4xx or 5xx)
    data = response.json()
    print("Validation Result:", data)
except requests.exceptions.HTTPError as http_err:
    print(f"HTTP error occurred: {http_err}")
except Exception as err:
    print(f"Other error occurred: {err}")

Ensure the requests library is installed: pip install requests.

Security best practices

Protecting your Disify API key is essential to maintain the security and integrity of your application and account. Adhering to these best practices can mitigate common risks associated with API key usage:

• Use HTTPS Always: Ensure all requests to the Disify API are made over HTTPS. This encrypts the communication channel, preventing your API key from being intercepted in plain text during transit. All modern browsers and HTTP client libraries default to HTTPS for secure connections, but it's important to verify this in your implementation. The Mozilla Developer Network provides extensive information on secure contexts and the importance of HTTPS.
• Never Expose Keys in Client-Side Code: Do not embed your Disify API key directly into front-end code (e.g., JavaScript running in a browser or mobile application). Client-side code is easily inspectable, making your key vulnerable to extraction. Instead, route API calls through a secure backend server that can manage and store the API key securely.
• Store Keys Securely: Your API key should be stored in a secure location. For server-side applications, use environment variables, a dedicated secrets management service (e.g., AWS Secrets Manager, Google Cloud Secret Manager, Azure Key Vault), or a secure configuration file that is not committed to version control. Avoid hardcoding keys directly into your source code.
• Restrict Key Usage (if applicable): While Disify's API keys do not currently offer fine-grained permissions or IP restrictions, it is a general best practice to apply such restrictions when available from an API provider. For APIs that support it, limiting an API key to specific IP addresses or HTTP referrers can significantly reduce the impact of a compromise.
• Rotate Keys Regularly: Periodically generate a new API key and replace the old one. This practice, known as key rotation, limits the window of exposure if a key is ever compromised without your knowledge. After generating a new key, update all your applications to use the new key, then revoke the old one from your Disify dashboard.
• Monitor Usage: Regularly check your Disify account's usage statistics for any unusual activity that might indicate unauthorized use of your API key. Spikes in request volume or unexpected API calls could be signs of a compromised key.
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures. This can help identify issues with your API key (e.g., revoked, invalid) and prevent your application from exposing sensitive information in error messages.

By following these guidelines, you can significantly enhance the security posture of your integration with the Disify API and protect your account from potential threats. For more general guidelines on API key security, refer to resources like Kong's API security best practices guide.