Real-Time Email Verification at Sign-Up: A Developer's Guide
How to add a real-time email check to a sign-up form: when to call it, how to treat each result and how to keep the experience fast.
A real-time check at the form is the cheapest place to stop bad data. This is a practical approach that works with any stack.
Decide where to call
- On blur or on submit of the email field, not on every keystroke.
- Call your server, which calls the verification API, so your key never reaches the browser.
Handle each result
- Valid: continue.
- Invalid or typo: show a clear message and, for typos, suggest the corrected domain.
- Disposable: ask for a regular address.
- Risky or accept-all: allow the sign-up and confirm by email.
- Timeout or error: let the user continue; never block revenue because of a third-party delay.
Keep it fast
Set a short timeout (two or three seconds), cache results for the same address and debounce requests.
Protect your endpoint
Rate-limit by IP and session so the form cannot be abused to check lists of addresses.
Get started
Create a free account, generate an API key from the API page and follow the examples there. Each account has 100 free verifications every month to test the flow, and paid plans start at $19.90 a month for 25,000 verifications. Try single checks on the email checker first.
A minimal integration, step by step
- Send the address to the verification API when the form is submitted, with a short timeout (2 to 3 seconds).
- Read the status in the response.
- Decide per status (see the table below), and always have a fallback for errors and timeouts.
| Status | Suggested action |
|---|---|
| valid | accept |
| invalid | ask the user to correct it |
| disposable | ask for a permanent address |
| risky, accept-all | accept, mark as unconfirmed, send a confirmation email |
| unknown or timeout | accept, queue a re-check |
Why a confirmation email is still needed
Verification tells you the mailbox exists. A confirmation link tells you the person typing owns it. Use verification to cut bounces and typos before sending the confirmation, and the confirmation to prove consent. They solve different problems.
Keep your own system healthy
- Cache the result for an address for a day or two so repeated submits do not cost extra checks.
- Rate limit the form and the endpoint that calls the API. A form that verifies on every keystroke is an easy target for abuse.
- Never put an API key in front-end code. Call the verifier from your server.
- Log the status next to the user record so support can see why an address was rejected.
Try it first
The API is available from the account area after sign-up. Test the logic first with the single checker and read the result fields.
