Full Contact Authentication: API Key Setup and Security (2026)

Authentication overview

Full Contact provides identity resolution and data enrichment services primarily through a RESTful API. To access these services, clients must authenticate their requests. The primary method for authentication is through the use of an API key, which acts as a unique identifier and secret token for your application. This system ensures that only authorized applications can interact with Full Contact's endpoints, protecting both the client's data and Full Contact's infrastructure.

The API key is a string generated within your Full Contact developer account and must be included in every API request. Failure to provide a valid API key will result in an authentication error, typically an HTTP 401 Unauthorized or 403 Forbidden response. The API is designed for server-side integration, where the API key can be securely managed and kept confidential, minimizing exposure to end-users.

Full Contact's API handles various data types related to individuals and companies, making secure authentication a critical component of its operation. Adherence to secure authentication practices, such as transmitting credentials over HTTPS and rotating API keys, is essential for maintaining data integrity and compliance with privacy regulations like GDPR and CCPA compliance.

Supported authentication methods

Full Contact primarily supports API key authentication for accessing its services. This method is straightforward and widely adopted for secure communication between applications and APIs. While OAuth 2.0 is a common standard for delegated authorization, particularly for user-facing applications requiring third-party access without sharing user credentials, Full Contact's API is designed for direct application-to-application integration where an API key is sufficient for identifying and authorizing the client application itself.

API keys are typically transmitted within the request headers or as query parameters. Full Contact's documentation specifies that the API key should be included in the X-FullContact-APIKey HTTP header for most endpoints. This approach helps keep the key separate from the URL path, slightly reducing its exposure in logs compared to URL parameters, though both methods require HTTPS for true transport security.

For context, other APIs may use methods like OAuth 2.0 for delegated authorization, which allows users to grant third-party applications limited access to their resources without exposing their credentials. However, for direct machine-to-machine communication, API keys are a common and effective solution when secured properly.

Getting your credentials

To begin using the Full Contact API, you need to obtain an API key from your Full Contact developer account. The process generally involves signing up for an account and then generating a key within the developer dashboard.

1. Sign Up/Log In: Navigate to the Full Contact website and either sign up for a new account or log in to your existing one. Access to the API typically requires a paid plan or a free trial subscription, as detailed on the Full Contact pricing page.
2. Access Developer Dashboard: Once logged in, look for a section labeled 'Developer', 'API Access', or similar within your account settings or dashboard. This is where API keys are managed.
3. Generate API Key: Within the developer section, there should be an option to generate a new API key. Full Contact may allow you to create multiple keys for different environments (e.g., development, staging, production) or applications, which is a recommended security practice. When generating a key, you might be prompted to label it for easier management.
4. Record Your Key: After generation, the API key will be displayed. It is crucial to copy and store this key securely immediately, as it may not be retrievable later once you navigate away from the page. Treat your API key with the same level of confidentiality as a password.

Full Contact's official documentation provides specific, up-to-date instructions for navigating their dashboard and generating API keys. Always consult these resources for the most accurate steps.

Authenticated request example

Once you have obtained your API key, you can include it in your API requests. Full Contact's API typically expects the API key to be sent in an HTTP header named X-FullContact-APIKey. All requests must be made over HTTPS to encrypt the API key and other sensitive data during transit.

Here is an example of an authenticated request using curl, a common command-line tool for making HTTP requests. This example demonstrates a request to a hypothetical Full Contact endpoint for person enrichment:

curl -X GET \
  'https://api.fullcontact.com/v3/[email protected]' \
  -H 'Content-Type: application/json' \
  -H 'X-FullContact-APIKey: YOUR_API_KEY'

In this example:

• -X GET specifies the HTTP method.
• 'https://api.fullcontact.com/v3/[email protected]' is the target API endpoint and a query parameter for the email address to enrich.
• -H 'Content-Type: application/json' sets the content type of the request.
• -H 'X-FullContact-APIKey: YOUR_API_KEY' is the critical header where you replace YOUR_API_KEY with the actual API key you obtained from your Full Contact developer dashboard.

For programmatic integration, you would use an HTTP client library in your chosen programming language (e.g., Python's requests, Node.js's axios, Java's HttpClient) to construct the request with the appropriate header. The Full Contact API reference offers detailed examples in various languages.

Security best practices

Securing your API keys is paramount to protect your data and prevent unauthorized access to your Full Contact account. Follow these best practices:

1. Use HTTPS Always: Ensure all API requests are made over HTTPS (HTTP Secure). This encrypts the communication channel between your application and Full Contact's servers, preventing your API key and other sensitive data from being intercepted by attackers. The IETF's RFC 2818 defines HTTP Over TLS, which underpins this security.
2. Store API Keys Securely: Never hardcode API keys directly into your source code. Instead, use environment variables, a secrets management service (e.g., AWS Secrets Manager, Google Secret Manager), or a secure configuration file that is not committed to version control.
3. Restrict API Key Privileges: If Full Contact offers the ability to assign different permissions to API keys, grant only the minimum necessary privileges for each key. This principle of least privilege limits the potential damage if a key is compromised.
4. Rotate API Keys Regularly: Periodically generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. The recommended rotation frequency can vary, but quarterly or bi-annually is a common starting point.
5. Monitor API Key Usage: Keep an eye on your API usage through the Full Contact developer dashboard. Unusual spikes in activity or requests from unexpected geographical locations could indicate a compromised key.
6. Implement IP Whitelisting: If Full Contact supports it, configure your API keys to only accept requests originating from a specific list of IP addresses that you control. This adds an extra layer of security, ensuring that even if a key is stolen, it cannot be used from unauthorized locations.
7. Error Handling and Logging: Implement robust error handling in your application to catch authentication failures. Log these errors securely, but avoid logging the API key itself. This helps in identifying and responding to potential security incidents.
8. Avoid Client-Side Exposure: Never expose your API keys in client-side code (e.g., JavaScript in a web browser, mobile app code). Client-side applications are inherently less secure environments for secret management due to their accessibility by end-users.

By implementing these security measures, you can significantly reduce the risk of unauthorized access and ensure the secure and reliable operation of your integration with Full Contact's API.