Email verification in JavaScript: server-side integration
Call the authenticated verification API from your server, not from public browser JavaScript. That keeps the identifier private and gives your application control over credits, retries and data handling. Browser-side syntax checks can still provide immediate feedback before the server request.
Open the relevant free tool →Keep the credential on your server
Keep credentials out of the browser
An API token embedded in a frontend bundle can be copied and used outside your interface. Store it in server configuration and authorize your own users before invoking the paid endpoint. Do not expose an unrestricted proxy that lets any visitor spend your account’s credits. Apply input limits and rate controls at your application boundary.
Persist a request identifier
Create a stable identifier for the logical verification and save it before calling the API. Reuse it after a timeout or worker restart. A new identifier means a new operation and can spend another credit. If the address or SMTP setting changes, treat it as a new request rather than reusing an identifier for different input.
Parse HTTP errors separately from results
fetch does not reject solely because an HTTP response is 400 or 500. Check response.ok before treating the body as a verification result. Keep 402 as an insufficient-credit condition, 429 as a rate-limit condition and an in-flight 409 as a retryable operation state where appropriate. None of these responses says the email is invalid.
Preserve uncertain fields
Do not use Boolean(result.checks.mailbox), because that collapses null into false. Store the original tri-state entry. Render address strings with text-safe APIs and escape entries used in HTML. Avoid letting a result score overwrite consent, suppression or account-confirmation fields in your data model.
Test the full lifecycle
Exercise successful responses, validation errors, exhausted credits and network timeouts with a mock before using real contacts. Verify that the UI shows pending and failed request states honestly. Run a small authorised live sample after API access is available. For agent clients, the supplied MCP connector follows the same endpoint and idempotency model; it does not bypass account limits.
Worked example
A request checks pat@example.com. If the connection fails, retry with the same request identifier. If the response says unknown, save it for review. See the API documentation for the exact HTTP headers and runnable code.