FullContact Authentication: API Key Security & Use (2026)

Authentication overview

FullContact secures access to its API primarily through the use of API keys. An API key serves as a unique identifier for an application or user when interacting with the FullContact platform. It functions as a secret token that must be presented with each API request to verify the client's identity and authorize access to specific resources and functionalities. This method is widely adopted for its simplicity and effectiveness in managing programmatic access to web services.

Access to the FullContact API requires your application to include the API key in the Authorization header of every HTTP request. This typically takes the form of a Bearer token, which is a common pattern for token-based authentication in RESTful APIs. For more details on the general principles of API key usage, consult the IBM API Connect documentation on API key usage.

FullContact provides a developer portal where users can generate, manage, and revoke their API keys. This portal also offers insights into API usage, allowing developers to monitor their consumption against their plan limits. The API key model supports various programming languages through official SDKs, simplifying the integration process for developers using Python, Node.js, Ruby, PHP, Java, and .NET.

Supported authentication methods

FullContact's API primarily supports API key authentication. This method is suitable for most use cases, from server-side applications to client-side integrations where the key can be securely managed. The system relies on the confidentiality of the API key to prevent unauthorized access.

API Key Authentication

The API key is a unique string assigned to your FullContact account. When making an API request, this key must be included in the Authorization header with the Bearer scheme. For example, a request might include Authorization: Bearer YOUR_API_KEY. This approach is straightforward and effective for authenticating individual API calls.

Table: FullContact Authentication Methods

Getting your credentials

To obtain your FullContact API key, you will need to register for a FullContact account and access the developer portal. The process generally involves the following steps:

1. Sign Up/Log In: Navigate to the FullContact website and either create a new account or log in to an existing one. FullContact offers a Developer plan with 100 API calls per month, which includes API access for testing and development.
2. Access Developer Portal: Once logged in, locate the developer section or API dashboard. This is typically accessible from your account settings or a dedicated 'Developers' link.
3. Generate API Key: Within the developer portal, you will find an option to generate new API keys. Follow the prompts to create a new key. You may be able to label your keys for easier management, especially if you plan to use multiple keys for different applications or environments.
4. Secure Your Key: Upon generation, your API key will be displayed. It is crucial to copy this key immediately and store it securely. FullContact typically displays the key only once for security reasons. Treat your API key as a sensitive credential, similar to a password.
5. Refer to Documentation: For the most up-to-date and specific instructions, always consult the FullContact API Reference on generating and managing API keys.

Authenticated request example

After obtaining your API key, you can use it to make authenticated requests to the FullContact API. The API key must be sent in the Authorization header with the Bearer prefix. Below are examples using cURL and Python, demonstrating how to include your API key.

cURL Example

This cURL example demonstrates a request to the FullContact Person API, enriching data for a specific email address. Replace YOUR_API_KEY with your actual API key.

curl -X POST \
  'https://api.fullcontact.com/v3/person.enrich' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "email": "[email protected]" }'

Python Example

Using the official FullContact Python SDK, authentication and request handling are simplified. First, ensure you have the SDK installed (pip install fullcontact).

import fullcontact

# Initialize the client with your API key
client = fullcontact.FullContactClient(api_key='YOUR_API_KEY')

# Make an enrich request
try:
    person_data = client.person.enrich(email='[email protected]')
    print(person_data)
except fullcontact.FullContactException as e:
    print(f"Error: {e}")

For more detailed examples and SDK usage, refer to the FullContact developer documentation.

Security best practices

Maintaining the security of your API keys is paramount to protect your data and prevent unauthorized usage of your FullContact account. Adhere to these best practices:

• Keep API Keys Confidential: Treat your API key as a password. Never hardcode API keys directly into client-side code (e.g., JavaScript in a public web application) or commit them to public version control repositories. Store them in environment variables, secret management services, or encrypted configuration files.
• Use Environment Variables: For server-side applications, store API keys in environment variables (e.g., FULLCONTACT_API_KEY=YOUR_API_KEY). This ensures the key is not part of your codebase and can be easily changed without modifying code.
• Implement Least Privilege: If FullContact introduces granular permissions for API keys in the future, generate keys with only the necessary permissions required for the specific task or application.
• Regularly Rotate Keys: Periodically generate new API keys and revoke old ones. This practice limits the window of exposure if a key is compromised. FullContact's developer portal allows for easy key rotation.
• Monitor API Usage: Regularly check your API usage statistics in the FullContact developer portal. Unusual spikes in usage could indicate a compromised key or unauthorized activity.
• Secure Your Development Environment: Ensure that your development machines and deployment pipelines are secure. Access to these environments could expose your API keys.
• Avoid Public Repositories: Never push code containing API keys to public repositories like GitHub. Use .gitignore files to exclude configuration files that contain sensitive credentials. Tools like GitGuardian can help detect exposed secrets in repositories, as detailed in GitGuardian's explanation of API keys.
• Use HTTPS: Always ensure that all communications with the FullContact API are made over HTTPS. This encrypts the data in transit, protecting your API key from interception.
• Error Handling: Implement robust error handling in your application to gracefully manage authentication failures, which could include logging attempts and notifying administrators.

By following these security guidelines, you can significantly reduce the risk of unauthorized access to your FullContact account and ensure the integrity of your data enrichment processes.