# Authentication and keys

Source: https://veriport.io/docs/authentication (published 2026-10-24)

Send the key as `Authorization: Bearer vp_live_…`. One key per verified e-mail address; the key is shown once, stored as a hash, and can be revoked by its holder or by us.

- Key format: `vp_live_` followed by 32 characters. `X-Api-Key: …` is accepted for clients that cannot set `Authorization`.
- A revoked key cannot be restored: sign up again with the same address after revoking.
- The tier is derived from the key’s state: an active monthly plan, else unexpired credits, else free. No tier is configured by hand.
- Browser calls are allowed (CORS `*`), but a key in browser code is public: call from your server, or use the anonymous allowance for demos.

## Tiers

What a caller may do depends on the tier the key is in at the moment of the call.

| Tier | How you get it | Calls | Requests / s | Consultation number | Bulk |
|---|---|---|---|---|---|
| No key | Nothing | 20 a day per address | 1 | No | No |
| Free | E-mail sign-up, confirmed | 100 a month | 2 | No | No |
| Prepaid credits | $9 / 2,000 or $29 / 10,000, valid 12 months | 100 a month free, then credits | 5 | Yes | No |
| Monthly plan | $15 a month | 5000 a month, then credits if any | 10 | Yes | Yes, 100 items a request |

## Getting a key

Type an e-mail at /signup. A confirmation link arrives (double opt-in: no key exists until you click). The page the link opens shows the key once; copy it into your secret store. Disposable-mail domains are refused and one address holds one active key at a time, which is the abuse control that lets the free tier exist without a card. The link expires after 7 days and unconfirmed addresses are deleted then.

## Checking usage

`GET /me` with your key returns the tier, the month’s calls against the allowance, the credit balance and its earliest expiry, and the plan state. It is free (not counted). The same view is on the account page, where you paste the key; the page never stores it.

## Revoking

`POST /account/revoke` with the key in `Authorization` revokes it immediately. We also revoke keys that abuse the service (scraping VIES at a rate that gets our address blocked, for instance) and say so in the changelog when it affects a published limit.

## Questions

### Can I have several keys?

One active key per verified e-mail address. Use one address per environment (staging, production) if you need separate keys; credits and plans attach to the key, so buy them from the address that holds the production key.

### What happens to credits when a key is revoked?

They stay attached to the revoked key and cannot be used. Revoke only to rotate a leaked key, and write to us first if credits are at stake: we move them by hand.

## Read next

- [Rate limits and quotas](https://veriport.io/docs/rate-limits)
- [Pricing](https://veriport.io/pricing)
- [Reference: /me](https://veriport.io/docs/account)