Verification is triggered only by HTTP POST. Opening /verify in a browser (a GET request)
will not run a check—that pattern is intentional.
Endpoint summary
| Method | POST only — GET is not supported on /verify |
|---|---|
| Path | /verify (on your deployed API origin) |
| Body | JSON body with field email (example: {"email":"user@email.com"}) |
| Auth | Header X-API-Key when your server sets API_KEY |
Example (curl)
curl -sS -X POST "https://YOUR_API_HOST/verify" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_KEY_IF_SET" \
-d '{"email":"user@email.com"}' Response overview
Prefer classification for product UX and notes / raw SMTP data for troubleshooting. Do not expose production API keys to browsers.
CORS
The verifier may allow comma-separated origins via CORS_ORIGINS. Narrow this list if you expose
browser callers; otherwise integrate from your backend only.