# Authentication

All API v2 requests are authenticated with an API key passed in the `x-api-key` header.

You can create and manage API keys in your [GetProspect account settings](https://app.getprospect.com/settings/api).

> **Keep your key secret**
>
> Your API key grants access to your account's credits. Never expose it in
> client-side code or public repositories. Rotate it from account settings if it
> leaks.

## Request format

- Base URL: `https://api.getprospect.com`
- Header: `x-api-key: YOUR_API_KEY`
- Header: `Content-Type: application/json` (for POST requests)

```bash
curl --request POST \
  --url https://api.getprospect.com/v2/email/verify \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: YOUR_API_KEY' \
  --data '
{
  "data": {
    "email": "team@microsoft.com"
  }
}
'
```

A missing or invalid key returns `401 Unauthorized`:

```json
{
  "success": false,
  "data": null,
  "metadata": {
    "timestamp": "2026-07-24T16:00:07.801Z"
  },
  "errors": [
    {
      "name": "UNAUTHORIZED",
      "message": "Unauthorized"
    }
  ]
}
```

A valid key without enough credits returns `402 Payment Required` - see
[Credits and rate limits](https://getprospect.com/api-docs/credits-and-limits.md).