Skip to Content
Getting StartedIntroduction

Introduction

VerifNow is a validation API for the fields billing and onboarding forms depend on: EU VAT numbers, IBANs, national tax and social identifiers, emails and phone numbers. One API key, one quota, one invoice — instead of three vendors for three fields.

It is built for the developer on the other side of a checkout or a signup form, who has to decide in real time whether to accept what a user just typed.

Why data validation?

Bad data costs money at the point it enters your system:

  • An unverified VAT number means reverse-charge invoicing you cannot defend in an audit
  • A mistyped IBAN means a transfer that fails days later, with a returned-payment fee
  • Disposable addresses inflate your user counts with fake accounts
  • Typos frustrate users who genuinely want to sign up — and a typo like gmial.com resolves to a real domain, so it looks deliverable
  • Invalid phone numbers lead to failed communications

VerifNow catches these at the point of entry, while the user is still in front of the form.


How it works

VerifNow performs a multi-layer validation pipeline. For email validation, the following checks are performed:

CheckDescription
Syntax validationEnsures the address follows valid email format
MX record lookupConfirms the domain has valid mail exchange records
Disposable detectionFlags known throwaway email providers
Role account detectionIdentifies addresses like info@, admin@, noreply@
Free provider detectionMarks addresses from Gmail, Yahoo, Hotmail, etc.
Typo detectionDetects typos and suggests the correct domain
Domain ageReports the age of the domain in days
MX provider & qualityIdentifies the mail provider and scores its quality
Risk scoringReturns a risk score (0–100) and risk level
Deliverability assessmentEvaluates if the email is deliverable

Base URL

All validation requests are made to:

https://api.verifnow.io/api/v1/validate

Validation endpoints

All endpoints accept a POST request with a JSON body containing the value to validate:

{ "value": "user@example.com" }
TypeEndpointGuide
VAT (EU)POST /api/v1/validate/vatValidate VAT
IBANPOST /api/v1/validate/ibanValidate IBAN
EmailPOST /api/v1/validate/emailValidate Email
PhonePOST /api/v1/validate/phoneValidate Phone
NIF (Spain)POST /api/v1/validate/nifValidate NIF (Spain)
NAS (Canada)POST /api/v1/validate/nasValidate SIN (NAS)
SSN (US)POST /api/v1/validate/ssnValidate SSN (US)

Authentication

VerifNow uses API key authentication. Every request must include your API key in the X-API-KEY header.

X-API-KEY: your_api_key_here

Keep your API key out of your source code and client-side bundles. Use environment variables.

Getting your API key

  1. Sign up at app.verifnow.io 
  2. Navigate to Settings → API Keys
  3. Click Create new key
  4. Copy the key — it will only be shown once

Store it as an environment variable:

# .env.local VERIFNOW_API_KEY=your_api_key_here

Plans & quotas

PlanValidations per billing periodConcurrent requestsMax API keysOverage behavior
FREE25031Blocked
STARTER10,00052Billed per unit
GROWTH50,000105Billed per unit
PRO150,0002520Billed per unit
  • FREE plan: requests are blocked once the limit is reached. FREE runs the same STANDARD validation depth as STARTER — see Validation depth by plan.
  • Paid plans (STARTER, GROWTH, PRO): requests above the quota are billed per unit at the end of the billing period.
  • Concurrent requests: all plans enforce a maximum number of simultaneous requests. Exceeding this returns a 429 error. On non-PRO plans, a 429 can also happen temporarily because of shared server-side concurrency protection, even if you are still within your documented per-plan limit.
  • Quota reset: quotas are reset at the start of each billing period (e.g., if your subscription started on the 4th, quotas reset every 4th of the month for a monthly subscription).

See Rate Limits for more details.


Response format

All validation responses share a common structure:

{ "valid": true, "message": "Email address is valid but has risk factors", "normalizedValue": "user@example.com", "originalValue": "user@example.com", "validationLevel": "PREMIUM" }

For email validations, an additional emailDetails field is included:

{ "valid": true, "message": "Email address is valid but has risk factors", "normalizedValue": "user@example.com", "originalValue": "user@example.com", "validationLevel": "PREMIUM", "emailDetails": { "signals": { "syntax_valid": true, "mx_valid": true, "typo_detected": false, "suggested_domain": null, "disposable": false, "role_based": false, "free_provider": false, "domain_age_days": 11554, "mx_provider": "google", "mx_quality_score": 0.9 }, "risk_score": 30, "risk_level": "MEDIUM", "deliverability": "RISKY", "applied_level": "PREMIUM" } }

Key fields

FieldDescription
validWhether the value passed validation
messageHuman-readable validation summary
normalizedValueThe cleaned/normalized version of the input
originalValueThe original value as submitted
validationLevelThe validation depth applied (e.g., PREMIUM)
emailDetails(Email only) Detailed email-specific signals and scoring

Risk levels (email)

Risk LevelMeaning
LOWLow risk — safe to use
MEDIUMMedium risk — some risk factors detected
HIGHHigh risk — significant risk factors

Deliverability values (email)

DeliverabilityMeaning
DELIVERABLEThe email is deliverable with high confidence
RISKYThe email may be deliverable but has risk factors
UNDELIVERABLEThe email is invalid, or its risk signals add up to a high risk (for example a likely typo)

valid is false only for invalid syntax, a domain with no mail records, or a blocked domain. Risk signals affect deliverability and risk_score, never valid, and the verdict is the same on every plan.


SDKs & libraries

Node.js and TypeScript

npm install @verifnow/sdk

Typed methods for all seven rules, no runtime dependencies, ESM and CommonJS. It throws a typed error when the API is unreachable rather than reporting an unverified value as valid.

Java and Spring Boot

<dependency> <groupId>io.verifnow</groupId> <artifactId>verifnow-spring-boot-starter</artifactId> <version>2.7.0</version> </dependency>

Auto-configured beans and Jakarta Bean Validation annotations (@VerifNowEmail, @VerifNowIban…).

If you are on verifnow-spring 2.1.0 or earlier, upgrade. Those versions defaulted to a hostname that does not resolve and, combined with the fail-open default, silently reported every value as valid.

For other languages, use the REST API directly — it’s just a few lines of code. See the Examples section.

Support

Last updated on