# Authentication

Core checks work **without authentication**. A free account provides an API key and higher limits; a paid plan can add more capacity or [premium features](https://docs.disify.com/guide/premium-features.md).

## API keys

Pass your API key in either the `X-Api-Key` header or an `Authorization: Bearer` header.


**X-Api-Key**

```bash
curl -H "X-Api-Key: YOUR_API_KEY" \
  https://disify.com/api/email/test@gmail.com
```

**Bearer**

```bash
curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://disify.com/api/email/test@gmail.com
```


Create and manage keys on the [API Keys page](https://disify.com/account/keys). Keep keys server-side — never ship them in frontend code.

## Usage tiers

| Tier | Request rate | Validation quota | Bulk limit | Features |
| --- | --- | --- | --- | --- |
| **Anonymous** (no key) | 30/min | 1,000/day per IP | 10,000 | Core features |
| **Free** (with account) | 60/min | 10,000/day, 30,000/month | 12,000 | Core features + API keys |
| **Starter** | 120/min | No monthly cap | 25,000 | Core + privacy relay detection and controls |
| **Pro** | 500/min | No monthly cap | 100,000 | Core + privacy relay controls + premium checks |

Each single check consumes one validation unit. A bulk request containing 450 unique entries consumes 450 units; duplicates within that batch count once. Checking the same input in another request consumes quota again. See [Rate Limits](https://docs.disify.com/guide/rate-limits.md).

See [pricing](https://disify.com/pricing) for full details, and [Credits](https://docs.disify.com/guide/credits.md) for pay-as-you-go overflow beyond your plan's limits.

**Which tier do I need?**

Choose capacity based on your request volume; core disposable detection is available on every tier. **Starter** includes [privacy relay detection and configurable rejection](https://docs.disify.com/api/forwarding.md). Choose **Pro** for the additional checks listed in [Premium Features](https://docs.disify.com/guide/premium-features.md).

## Rate limits at a glance

Limits apply per IP (anonymous) or per client account (authenticated). Multiple API keys on the same account share one allowance. Responses normally include:

- `X-RateLimit-Limit` — your per-minute limit
- `X-RateLimit-Remaining` — requests left in the current window

These headers can be absent on early failures or requests covered by credits. Exceeding a limit without available overflow credits returns `429`. See [Rate Limits](https://docs.disify.com/guide/rate-limits.md), including the temporary limits for new free accounts.

Source: https://docs.disify.com/guide/authentication.html