The API

The API lets your own systems check things for themselves:

• IP lookup: where an IP address is, who runs its network, and whether it's a VPN, proxy or Tor exit, or on a block list.
• Email check: whether an email address can receive mail, and whether it's a throwaway or free address.
• Prompt check: whether something a person typed for an AI looks like an attempt to make it misbehave.

Your developers call it with a key you make under Organisation › API. It's free with every paid plan. The API reference in this Help Center has every call, field and error for developers. The API page on our website has a playground to try each check without a key.

Who can use it#

• Every paid plan includes the API. There's nothing to buy or switch on.
• On the Free plan, the page says the API comes with every paid plan, with a Choose a plan button. Keys can't be made, and calls are refused.
• If your account is locked because a bill wasn't paid, the page says so, with a Pay now button. Calls are refused until the bill is paid. Your keys are kept.
• An organisation that isn't billed can always use it.
• Only owners and admins see API in the Organisation menu and can make or remove keys.

If the page says The API isn't available right now, the checks are down on our side. Calls get an error until they're back. Your keys keep working once they are.

Make a key#

Make one key for each system that calls the API, such as your sign-up form or your fraud checks. Then you can remove one without stopping the others.

1. 1

   Open Organisation › API and click Make a key.

2. 2

   Type a Name that says where it's used, such as "Sign-up form".

3. 3

   Tick Sign every call if you want the extra protection described below. Leave it off if you're not sure.

4. 4

   Click Make key.

The next window shows the whole key, with a Copy button. Keys start with cbk_.

An organisation can have up to 20 keys.

Signed calls#

A key made with Sign every call comes with a second secret, the signing secret. The window after making it shows both, each with a Copy button.

Each call must then also carry the time and a signature made with the signing secret. So:

• the key alone isn't enough to use the API;
• a call someone copies stops working after 5 minutes.

Your developer adds a few lines of code for this. Authentication and signed calls has examples. In the list, a key like this shows Signed calls next to its name.

You can't switch signing on or off for a key later. Make a new key instead.

Your keys#

The Keys table lists each key:

• Key: its name, and the start of the key, such as "Starts with cbk_Ab12cD34…", so you can tell keys apart. Signed calls shows for keys that need signing.
• Made: the day it was made, and by whom.
• Last used: the day a call last came with it, or Not yet.

Remove a key#

1. 1

   Click ⋯ at the end of the key's row, then Remove.

2. 2

   Confirm with Remove key.

The key stops working at once. Any system still using it gets an error. What it was used for stays in your usage.

Usage#

The Usage table shows, for IP lookup, Email check and Prompt check, how much your organisation used This month and Last month.

Each IP address, email address or prompt checked counts once, whichever key it came with. A call that checks 50 addresses counts 50.

How to call it#

The How to call it panel at the bottom shows the Address your systems call, with a Copy button, and an example call.

• Each call checks up to 100 IP or email addresses, or one prompt.
• Each key can make up to 10 calls a second.

For everything else, such as every field in the answers, signed calls, and examples in several programming languages, click Read the API docs. They're on our website at /api. The API reference in this Help Center has the same, and every error and limit.