FullContact API Authentication: Overview & Best Practices (2026)

Authentication overview

Authentication for the FullContact API establishes and verifies the identity of a client making requests to FullContact's data enrichment services. This process ensures that only authorized applications can access and manipulate data, protecting both the integrity of the API and the privacy of the data it provides. The FullContact API primarily uses API keys as its authentication mechanism, which are secret tokens issued to developers upon account creation. These keys act as unique identifiers for your application and grant access to the API's various endpoints, including those for person, company, and identity resolution data.

Proper management and secure handling of API keys are critical to prevent unauthorized access to your FullContact account and potential misuse of your API quota. All communications with the FullContact API must occur over HTTPS, an industry standard for secure communication over a computer network, to encrypt data in transit and protect API keys from interception. The API's architecture is built on RESTful principles, meaning authentication integrates directly into standard HTTP requests, typically through request headers. For a comprehensive understanding of the API's structure, refer to the FullContact API reference documentation.

Supported authentication methods

The FullContact API supports API key authentication, which is a common and straightforward method for securing access to web services. API keys are long, unique strings that are associated with your FullContact developer account. When you make a request to the FullContact API, you include this key to identify yourself and prove that you are authorized to access the requested resources.

API Key Authentication

• Mechanism: API keys are secret tokens passed with each request. FullContact's system validates this key to grant access.
• Usage: The API key is typically sent in the Authorization header of an HTTP request, prefixed with Bearer, or as a query parameter. The recommended and more secure method is using the Authorization header.
• Scope: API keys granted through the FullContact developer portal usually have broad access to the endpoints available under your subscription tier, such as the Person Enrichment API or Company Enrichment API.
• Security Considerations: API keys should be treated as sensitive credentials, similar to passwords. They should never be hardcoded directly into client-side code, exposed in public repositories, or transmitted over insecure channels.

While API keys are a prevalent authentication method, understanding their limitations and proper usage is important. For instance, unlike OAuth 2.0, API keys typically do not provide granular permissions management or user delegation. They grant access to the application itself, not on behalf of specific end-users. For a general overview of API authentication methods, resources like the MDN Web Docs on HTTP authentication provide additional context.

Authentication Method Comparison

The following table outlines the primary authentication method supported by FullContact API:

Getting your credentials

To begin using the FullContact API, you need to obtain an API key. This process involves creating an account on the FullContact developer portal and generating a new key. Follow these steps to acquire your credentials:

1. Sign Up for a FullContact Account: Navigate to the FullContact pricing page and choose a plan. FullContact offers a free tier that includes 500 API calls per month, which is suitable for testing and development. Complete the registration process to create your account.
2. Access the Developer Dashboard: Once your account is active, log in and access the FullContact Developer Dashboard. This dashboard is your central hub for managing API keys, monitoring usage, and accessing documentation.
3. Generate an API Key: Within the Developer Dashboard, locate the section for API keys or credentials. There will typically be an option to generate a new API key. Click this option, and the system will generate a unique key for you.
4. Securely Store Your Key: Immediately after generation, copy your API key and store it securely. FullContact generally only displays the key once upon creation; if you lose it, you may need to generate a new one. Do not share your API key publicly or embed it directly into client-side code.
5. Review Usage Limits: Familiarize yourself with the FullContact API documentation regarding rate limits and usage policies associated with your API key and subscription plan.

It is recommended to generate separate API keys for different applications or environments (e.g., development, staging, production) to enhance security and simplify key rotation or revocation if a key is compromised. The Developer Dashboard provides tools to manage these keys, including options to revoke or regenerate them as needed.

Authenticated request example

After obtaining your API key, you can use it to make authenticated requests to the FullContact API. The most common and recommended method is to include the API key in the Authorization header of your HTTP request, using the Bearer scheme. This example demonstrates how to make a request to the FullContact Person Enrichment API using curl, a common command-line tool for making HTTP requests:

Example: Person Enrichment Request

This example queries for a person's information using an email address.

curl -X POST \ 
  'https://api.fullcontact.com/v3/person.enrich' \ 
  -H 'Authorization: Bearer YOUR_API_KEY' \ 
  -H 'Content-Type: application/json' \ 
  -d '{ 
    "email": "[email protected]" 
  }'

In this example:

• -X POST specifies the HTTP method as POST.
• 'https://api.fullcontact.com/v3/person.enrich' is the endpoint for the Person Enrichment API.
• -H 'Authorization: Bearer YOUR_API_KEY' is the crucial part for authentication. Replace YOUR_API_KEY with the actual API key you obtained from your FullContact Developer Dashboard. The Bearer prefix is standard for token-based authentication.
• -H 'Content-Type: application/json' indicates that the request body is in JSON format.
• -d '{ "email": "[email protected]" }' is the JSON request body containing the data to enrich.

Alternative: Query Parameter Authentication (Less Recommended)

While the header method is preferred, some FullContact API endpoints might also accept the API key as a query parameter (e.g., ?apiKey=YOUR_API_KEY). However, passing sensitive credentials in the URL is generally less secure because URLs can be logged in server logs, browser histories, and network devices, potentially exposing your key. Always prioritize using the Authorization header when possible.

curl -X GET \ 
  'https://api.fullcontact.com/v3/company.enrich?domain=fullcontact.com&apiKey=YOUR_API_KEY' \ 
  -H 'Content-Type: application/json'

This example demonstrates a GET request to the Company Enrichment API with the API key as a query parameter. For detailed endpoint specifications, consult the FullContact API reference.

Security best practices

Implementing robust security practices is essential when integrating with any API, especially one that handles sensitive data like FullContact. Adhering to these best practices will help protect your API keys and maintain the security of your applications.

API Key Management

1. Treat API Keys as Secrets: Your API key is like a password. Never embed it directly into client-side code (e.g., JavaScript in a web browser or mobile app). Instead, route all API calls through a secure backend server that can securely store and transmit the key.
2. Environment Variables: Store API keys in environment variables rather than hardcoding them in your application's source code. This practice prevents keys from being committed to version control systems like Git and makes it easier to manage different keys for different environments (development, staging, production).
3. Vaults and Secret Management Services: For production environments, consider using dedicated secret management services such as AWS Secrets Manager, Google Cloud Secret Manager, or HashiCorp Vault. These services provide secure storage, access control, and rotation capabilities for sensitive credentials.
4. Access Control: Implement strict access controls for anyone who can access or modify your API keys. Limit key exposure to only those personnel and systems that absolutely require it.
5. Key Rotation: Periodically rotate your API keys. FullContact's Developer Dashboard typically allows you to generate new keys and revoke old ones. Regular rotation minimizes the risk associated with a compromised key.
6. IP Whitelisting (if available): If FullContact offers IP whitelisting (restricting API key usage to specific IP addresses), enable it. This adds an extra layer of security, ensuring that even if a key is stolen, it can only be used from authorized networks.

Secure Communication

• Always Use HTTPS: Ensure all communications with the FullContact API are made over HTTPS (TLS). This encrypts data in transit, protecting your API key and other sensitive information from eavesdropping. The FullContact API strictly enforces HTTPS for all requests.
• Validate SSL/TLS Certificates: When making API calls from your application, always validate the SSL/TLS certificate of the FullContact API endpoint. This prevents man-in-the-middle attacks where an attacker might try to impersonate the API server.

Error Handling and Logging

• Avoid Logging API Keys: Configure your application's logging systems to never log API keys or other sensitive authentication details. If debugging requires visibility into requests, ensure keys are redacted or masked.
• Monitor for Unusual Activity: Regularly monitor your API usage and logs for any unusual patterns or spikes that could indicate unauthorized access or a compromised key. FullContact's Developer Dashboard may provide usage analytics to assist with this.

Compliance and Policies

• Adhere to FullContact's Terms of Service: Always review and comply with FullContact's terms of service and acceptable use policies, which cover the appropriate use of their API and data.
• GDPR and CCPA Compliance: As FullContact is compliant with GDPR and CCPA, ensure your application's data handling practices also align with these and other relevant data protection regulations if you are processing personal data.