EVA Authentication: API Key Setup & Security (2026)

Authentication overview

EVA uses API keys as its primary method for authenticating requests to its email validation and deliverability API. An API key is a unique identifier used to authenticate a user, developer, or calling program to an API. It acts as a secret token that verifies the identity of the application making requests, ensuring that only authorized entities can access EVA's services and consume account credits. This method is common for web services requiring straightforward access control and usage tracking Google Maps API key documentation.

When an API key is included in an API request, EVA's system validates the key against its records. A valid key grants access to the requested endpoint, while an invalid or missing key results in an authentication error, typically an HTTP 401 Unauthorized response. This mechanism helps secure API access and allows EVA to monitor and manage API usage effectively for each account.

Developers integrating with EVA's API will pass their API key with each request, typically in the request header or as a query parameter, depending on the specific endpoint's requirements. The official EVA documentation provides specific instructions and code examples for various programming languages to correctly implement API key authentication EVA API reference.

Supported authentication methods

EVA primarily supports API key authentication for accessing its services. This method is suitable for a wide range of applications, from server-side integrations to client-side scripts where the API key can be securely managed. The simplicity of API keys makes them a practical choice for many API consumers.

While API keys are the standard, their security relies heavily on proper handling and storage. For applications requiring more granular permissions or user-specific delegation without exposing a master key, alternative authentication schemes like OAuth 2.0 might be considered by other services OAuth.net official website. However, for EVA's current scope of email validation services, API keys offer a direct and efficient authentication mechanism.

Getting your credentials

To obtain your EVA API key, follow these steps:

1. Create an EVA Account: If you don't already have one, register for an account on the official EVA website EVA homepage.
2. Log In: Access your EVA account dashboard using your registered credentials.
3. Navigate to API Settings: Within your dashboard, locate the section related to API access, often labeled 'API Settings', 'Developers', or 'Account Settings'.
4. Generate API Key: Your unique API key will typically be displayed in this section. If it's not immediately visible, there might be an option to generate a new key. Some services allow you to regenerate keys for security purposes.
5. Copy Your Key: Carefully copy the displayed API key. It is a long string of alphanumeric characters. Treat this key as sensitive information, similar to a password.

EVA provides a free tier with 100 credits per month, which allows developers to obtain an API key and test the service without immediate financial commitment EVA pricing page. This is useful for initial integration and verifying the authentication process.

Authenticated request example

When making requests to the EVA API, your API key must be included. The EVA API typically expects the API key to be passed as part of the request body or as a query parameter, depending on the specific endpoint. Here's a common example using Python to validate an email address:

Python Example

import requests

# Replace with your actual EVA API key
API_KEY = "YOUR_EVA_API_KEY"
EMAIL_TO_VALIDATE = "[email protected]"

# EVA API endpoint for email validation
API_URL = "https://api.eva.id/v2/validate"

# Parameters for the API request
payload = {
    "key": API_KEY,
    "email": EMAIL_TO_VALIDATE
}

try:
    response = requests.get(API_URL, params=payload)
    response.raise_for_status() # Raise an HTTPError for bad responses (4xx or 5xx)

    data = response.json()
    print("Validation Result:")
    print(f"Email: {data.get('email')}")
    print(f"Status: {data.get('status')}")
    print(f"Deliverable: {data.get('deliverable')}")
    print(f"Reason: {data.get('reason')}")

except requests.exceptions.HTTPError as http_err:
    print(f"HTTP error occurred: {http_err}")
    print(f"Response content: {response.text}")
except requests.exceptions.ConnectionError as conn_err:
    print(f"Connection error occurred: {conn_err}")
except requests.exceptions.Timeout as timeout_err:
    print(f"Timeout error occurred: {timeout_err}")
except requests.exceptions.RequestException as req_err:
    print(f"An unexpected error occurred: {req_err}")

This example demonstrates how to construct a GET request including the API key as a query parameter key. Always refer to the specific endpoint documentation within the EVA API reference for exact parameter names and request methods.

Security best practices

Properly securing your API key is crucial to prevent unauthorized access to your EVA account and services. Adhering to these best practices can mitigate common security risks:

• Do Not Embed Keys Directly in Client-Side Code: Never hardcode your API key directly into public client-side code (e.g., JavaScript in a web browser, mobile app binaries). This exposes your key to anyone who inspects the code. Instead, use a backend server to make API calls, where the key can be securely stored and managed.
• Use Environment Variables: For server-side applications, store your API key as an environment variable rather than directly in your source code. This keeps the key out of version control systems and allows for easier rotation.
• Restrict API Key Usage: If EVA provides options to restrict API key usage (e.g., by IP address or HTTP referrer), configure these restrictions. This ensures that even if your key is compromised, it can only be used from authorized locations.
• Regular Key Rotation: Periodically regenerate your API key from the EVA dashboard. This practice, known as key rotation, limits the window of opportunity for a compromised key to be exploited.
• Secure Storage: Store API keys in secure, encrypted storage solutions. Avoid plain-text files or publicly accessible configuration files.
• Implement Least Privilege: If EVA offers different types of API keys with varying permissions, use the key with the minimum necessary privileges for each specific task.
• Monitor API Usage: Regularly review your API usage logs in the EVA dashboard. Unusual spikes in usage could indicate a compromised key or unauthorized activity.
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures. Avoid logging API keys in error messages, as this could inadvertently expose them.
• HTTPS Only: Always ensure all API requests are made over HTTPS. This encrypts the communication channel, protecting your API key and other data from eavesdropping during transit. The IETF recommends Transport Layer Security (TLS), which HTTPS uses, for secure communication over networks IETF RFC 8446 for TLS 1.3.

By following these guidelines, developers can significantly enhance the security posture of their applications when integrating with EVA's API.