Authentication

Every request to POST /v1/check must include your API key. Send it as a bearer token:

POST /v1/check HTTP/1.1
Host: api.signitize.io
Authorization: Bearer sk_live_7Hq2LmX9pR4tVb8Kc1NwZ3yF6dJs0GaE5uQoWiTn
Content-Type: application/json

{"email":"[email protected]"}

If your HTTP client makes the Authorization header awkward, the X-API-Key header works too:

curl https://api.signitize.io/v1/check \
  -H "X-API-Key: $SIGNITIZE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

Keep the key secret

• Call Signitize from your backend only, never from browser or mobile app code. Anyone who sees the key can spend your quota.
• Store it in an environment variable (such as SIGNITIZE_API_KEY) or a secrets manager, not in source control.
• If it leaks, get a new key: the old one stops working the moment you reveal the new one.

Failed authentication

A missing or invalid key returns 401 with type: "AuthorizationError". The message tells you which:

Situation	message
No Authorization: Bearer header and no X-API-Key header	Missing API key. Send it as "Authorization: Bearer <key>".
The key is malformed, unknown, or was replaced by a new key	Invalid or revoked API key.

{
    "error": {
        "type": "AuthorizationError",
        "message": "Missing API key. Send it as \"Authorization: Bearer <key>\"."
    }
}

Requests that fail authentication are not counted toward your quota. Every other status code is in Errors.