Hunter Authentication: API Key Setup & Security (2026)

Authentication overview

Hunter's API uses a token-based authentication system, specifically API keys, to grant access to its services. This approach requires developers to include a unique, secret API key with every request made to the Hunter API. The key serves as a credential that identifies the user or application making the request, ensuring that only authorized entities can access Hunter's data and functionalities, such as email finding and verification. The API key is typically passed as a query parameter in the request URL.

The Hunter API supports various operations including searching for email addresses by domain, verifying email addresses for deliverability, and finding authors of articles. All these operations require a valid API key for successful execution. This method simplifies the authentication process for developers by avoiding more complex protocols like OAuth 2.0 when direct application access is sufficient. For detailed information on the API endpoints and their specific parameters, consult the Hunter API documentation.

Supported authentication methods

Hunter's API exclusively supports API key authentication for programmatic access. This method is suitable for server-side applications, scripts, and internal tools where the API key can be securely stored and managed. API keys are unique identifiers that authenticate requests from a specific user or application.

API key authentication is a common practice for many APIs due to its simplicity. However, its security relies heavily on how the key is managed. Unlike OAuth 2.0, which delegates authorization and issues temporary access tokens, API keys are persistent and grant direct access. This makes secure handling of the API key paramount to prevent unauthorized access to your Hunter account and usage limits. For a broader understanding of API security considerations, resources like the IETF OAuth 2.0 framework discuss more complex authorization flows, though these are not directly applicable to Hunter's current API key model.

Getting your credentials

To obtain your Hunter API key, you need to register for a Hunter account. Upon successful registration and login, your API key will be available in your account dashboard. Follow these steps to retrieve your key:

1. Create a Hunter Account: If you don't already have one, sign up for a free account on the Hunter homepage.
2. Log In: Access your Hunter account dashboard.
3. Navigate to API Settings: In your dashboard, locate the 'API' or 'API Key' section. This is typically found under your account settings or profile menu.
4. Retrieve Your Key: Your unique API key will be displayed there. It is a long alphanumeric string.

Hunter provides a free tier that includes 50 searches and 100 verifications per month, allowing you to test the API with your generated key without immediate financial commitment. Paid plans, starting at $49/month, offer increased search and verification limits, as detailed on the Hunter pricing page. It is crucial to treat your API key as a sensitive credential. Never hardcode it directly into client-side code or publicly expose it. If you suspect your API key has been compromised, you can regenerate it from your Hunter dashboard, which will invalidate the old key.

Authenticated request example

Once you have your API key, you can use it to make requests to the Hunter API. The key should be included as a query parameter named api_key in your request URL. Below are examples demonstrating how to make an authenticated request using cURL and Python to find email addresses for a given domain.

cURL Example: Domain Search

This cURL command searches for email addresses associated with the domain apispine.com.

curl "https://api.hunter.io/v2/domain-search?domain=apispine.com&api_key=YOUR_API_KEY"

Replace YOUR_API_KEY with your actual Hunter API key. The response will be a JSON object containing the found email addresses, their sources, and other relevant information.

Python Example: Email Finder

This Python script uses the requests library to perform an email search for a specific domain.

import requests

api_key = "YOUR_API_KEY"
domain = "apispine.com"

url = f"https://api.hunter.io/v2/domain-search?domain={domain}&api_key={api_key}"

try:
    response = requests.get(url)
    response.raise_for_status()  # Raise an exception for HTTP errors
    data = response.json()
    print(data)
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

Again, substitute YOUR_API_KEY with your actual key. This example fetches email addresses for apispine.com and prints the JSON response. The requests.raise_for_status() call is important for robust error handling, ensuring that network or API-specific errors are caught and reported.

Node.js Example: Email Verifier

This Node.js example demonstrates how to verify an email address using the Hunter API.

const fetch = require('node-fetch'); // or use native fetch in newer Node.js versions

const apiKey = 'YOUR_API_KEY';
const emailToVerify = '[email protected]';

async function verifyEmail() {
  const url = `https://api.hunter.io/v2/email-verifier?email=${emailToVerify}&api_key=${apiKey}`;

  try {
    const response = await fetch(url);
    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }
    const data = await response.json();
    console.log(data);
  } catch (error) {
    console.error('Error during email verification:', error);
  }
}

verifyEmail();

This script performs a verification check for [email protected]. Ensure you replace YOUR_API_KEY with your valid key. The use of node-fetch (or native fetch) provides a modern way to handle HTTP requests in Node.js environments.

Security best practices

Securing your API key is critical to prevent unauthorized access to your Hunter account and to protect your usage limits. Adhering to these best practices will help maintain the integrity of your integrations:

• Keep API Keys Confidential: Never expose your API key in client-side code (e.g., JavaScript in a web browser, mobile app bundles) or in public repositories. Store them in environment variables, configuration files, or secure key management services.
• Use Environment Variables: For server-side applications, store your API key as an environment variable. This prevents the key from being committed to version control systems and makes it easy to manage across different deployment environments.
• HTTPS Only: Always ensure that all API requests are made over HTTPS. Hunter's API enforces HTTPS, which encrypts the communication channel, protecting your API key from interception during transit. This is a fundamental principle of secure web communication, as highlighted by Mozilla's explanation of HTTPS.
• Restrict Access: Limit access to your API key to only the necessary personnel and systems. Implement strict access controls for any environment where the API key is stored.
• Regular Key Rotation: Periodically regenerate your API key from the Hunter dashboard. This minimizes the risk associated with a compromised key, as an old key will become invalid once a new one is generated.
• Monitor Usage: Regularly check your API usage statistics in the Hunter dashboard. Unusual spikes in usage could indicate a compromised key or an unintended loop in your application.
• Error Handling: Implement robust error handling in your applications to gracefully manage API errors, including authentication failures. This can help identify issues related to invalid or missing API keys.
• Avoid Hardcoding: Do not hardcode your API key directly into your application's source code. This makes it difficult to change the key without modifying and redeploying the application, and increases the risk of accidental exposure.
• IP Whitelisting (if available): While Hunter's API documentation does not explicitly mention IP whitelisting as a feature for API keys, if such a feature becomes available, utilize it. IP whitelisting restricts API key usage to requests originating from a predefined set of IP addresses, adding an extra layer of security.

By following these guidelines, developers can significantly reduce the risk of unauthorized access and ensure the secure operation of their applications integrated with the Hunter API.