Bouncer: email verification API for developers

A real-time email validation API has to answer inside a form's time budget, so the measure that matters is what it does when a mail server is slow: a documented timeout, an explicit unknown status rather than a guess, and no charge for that unknown. Bouncer's real-time endpoint is documented with a 10-second default timeout and a 30-second maximum, returns unknown with the reason timeout at the limit, and Bouncer's pricing page states that unknown results are never charged (docs.usebouncer.com and the pricing page, read 4 November 2026).

In Cllimber's 11 September 2026 test, four single checks on the same engine the API uses returned in seconds and cost one credit each: a gnail.com typo came back risky with the suggestion gmail.com, a Mailinator address was flagged disposable, a role address was rejected and a real Gmail address was deliverable (email verification software for ecommerce stores). Accuracy was not measured: no control addresses were seeded and no campaign was sent. The checks were made in the app, not through the API endpoints, which were not run.

This article covers the email verification API as Bouncer documents it on 4 November 2026: the real-time email validation API, the batch email verification API, the response fields a disposable email detection API needs, the email verification MCP server, and what email validation API pricing looks like when the API shares the app's credits.

Who Bouncer fits, and what to weigh

Bouncer's API fits a developer who needs the same engine in three places: a synchronous check at a signup or checkout form, an asynchronous batch for lists and migrations, and a queue-style endpoint for pipelines that want synchronous results in chunks. The response is graded, with a status, a reason code, a 0–100 score, a 0–5 toxicity score and flags for disposable, role, free-provider, full-mailbox and accept-all addresses, so a form can treat a typo differently from a dead domain (API reference, read 4 November 2026). The same credits and the same organisation permissions apply whether an address arrives through the app, the API or the MCP server.

Four things to weigh. First, the real-time endpoint stops at its timeout, and Bouncer's own documentation says this returns about 5% more unknown results than the batch API; a form has to decide what to do with an unknown. Second, rate limits are documented and finite: 1,000 real-time requests a minute by default, 60 batch creations a minute, 100 batch-sync requests a minute (docs, read 4 November 2026); higher limits are described as configurable on request. Third, the batch ceiling is stated differently on two Bouncer pages: the API reference says a single batch can hold up to 100,000 addresses, with 1,000–10,000 suggested, while the API marketing page says a maximum of 500,000 (both read 4 November 2026). Fourth, Cllimber did not run the API: the figures in this article are Bouncer's documentation plus app-level checks on the same engine.

Hands-on test: four single checks and the credit count

On 11 September 2026 Cllimber ran four addresses through the single-check screen of the Bouncer app, which uses the engine the API exposes. Each returned in a few seconds and cost one credit. The first check cited in this article, and the credit-count check below, are published in full in Cllimber's email verification software for ecommerce stores article (published 16 September 2026, updated 4 October 2026).

Cllimber in-app test, 11 September 2026. Each check returned in a few seconds and cost one credit; a repeat of the real address was charged again, so the no-duplicates rule applies within a list only.

The second test is the credit count. In Cllimber's 8 September 2026 bulk run, 948 of 957 credits were charged and 9 were refunded on completion, matching the 9 unknown results (email verification software for ecommerce stores). That is the behaviour the pricing page describes, observed on the balance counter rather than read. Accuracy was not measured in either test: no control addresses were seeded and no campaign was sent. Bouncer Shield, AutoClean and the API endpoints were not run; they are described below from Bouncer's pages.

The endpoints: real-time, batch and batch-sync

A batch email verification API and a real-time email validation API are the same check with different time budgets, and Bouncer documents three ways in. The table is from the API reference at docs.usebouncer.com, read 4 November 2026; every figure is Bouncer's.

docs.usebouncer.com API reference and the Bouncer API page, read 4 November 2026. Throughput "by default" is Bouncer's phrasing; it says higher limits can be configured. Cllimber did not run any endpoint and did not measure latency or throughput.

For a list that arrives as a file rather than a stream, the batch endpoints are the route, and the volume questions that go with them, what 100,000 or a million addresses cost and how long Bouncer says a large list takes, are covered in Cllimber's article on bulk email verification for lists with 100,000+ contacts.

What the response carries

A disposable email detection API is only useful if the flag is a field, not a status, and Bouncer's response separates the two. Each result carries a status (deliverable, risky, undeliverable, unknown) and a reason from a documented list (accepted_email, low_deliverability, low_quality, invalid_email, invalid_domain, rejected_email, dns_error, unavailable_smtp, unsupported, timeout, unknown); a domain object with acceptAll, disposable and free; an account object with role, disabled and fullMailbox; the DNS record used; the provider; a 0–100 score; a toxic flag and a 0–5 toxicity integer (API reference, read 4 November 2026). In Cllimber's single checks the Mailinator address came back with disposable set to yes and the role address with role set to yes, which is the shape a signup handler needs to branch on.

Security and data residency as documented

Bouncer's API page lists the controls a security review asks about: the API key is accepted in the header only; multi-factor authentication can be switched on and required for all users of an account; API calls and logins can be restricted to named IP addresses or ranges; the page states "control where your data is processed" and that all data is stored in AWS European data centres (API page, read 4 November 2026). The Data Processing Amendment linked from Bouncer's GDPR page names the AWS Frankfurt region, states that data is not transferred outside the European Union, keeps personal data for up to 60 days before anonymisation and deletion, and is governed by Polish law (DPA, read 4 November 2026). SOC 2 is stated on Bouncer's email-verification page ("GDPR compliant, SOC 2 certified, EU data storage"), not on the pricing page or the API page (read 4 November 2026).

Organisation management applies to API keys as well as users: Bouncer's API page describes multiple organisations, teams and environments per account, with access to credits and features set per member. In Cllimber's 8 September 2026 test a member was invited with Verification and API permission tags into one organisation with a single shared credit pool (email verification software for marketing agencies). Where the API is called at the moment a CRM receives a lead rather than from a form, the scheduled re-verification that follows is the subject of Cllimber's article on automated CRM email list cleaning.

The email verification MCP server

An email verification MCP server exposes the API as tools an AI assistant can call, so verification happens inside a conversation rather than through an export and an upload. Bouncer publishes a remote MCP server at https://api.usebouncer.com/mcp, connected as a custom connector in Claude, through developer mode in ChatGPT, or as a remote MCP server in other compatible assistants; sign-in is OAuth 2.1, no API key is pasted into the chat, each connection appears in the Bouncer dashboard and can be revoked, and the page states there is no extra charge beyond the account's credits (Bouncer's MCP server page, read 4 November 2026). The tools listed are verify_email, verify_emails_sync, create_batch with check_batch_status and get_batch_results, verify_domain, create_toxicity_list with get_toxicity_results, and check_credits, returning the same four statuses as the app and API. Cllimber did not connect or run the MCP server.

Tool types compared: standalone verification and in-platform list hygiene

A validation routine built into a form library checks syntax and, at most, an MX record; it never asks the receiving server whether the mailbox exists, so anything@company.com passes. Hygiene built into an ESP or CRM acts after the address is stored, on that platform's data only. A standalone verification API such as Bouncer's talks to the mail server before the address is stored, returns a graded result, and serves the form, the pipeline and the CRM from one key and one credit pool. The cost of that reach is a second vendor in the chain, a key to manage, a processing agreement to sign off, and a design decision about what the form does with an unknown; the API latency trade-off itself is set out on Cllimber's API latency and bulk verification page.

Pricing and volume tiers

Bouncer publishes no separate API tariff: the pricing page lists verification credits, and Cllimber's ecommerce test recorded that one credit covers one address whether it is checked in bulk or through the API. The ladder below is from the Bouncer pricing page, read 4 November 2026. Per-1,000 figures are calculated from the listed totals.

Bouncer pricing page, read 4 November 2026. On-demand credits never expire; subscription credits arrive monthly and also never expire; duplicates within a list and unknown results are not charged; 100 free credits on signup with no card; auto-refill is available. The page lists no subscription prices, no payment methods and no VAT treatment. Bouncer Shield, the form script, is billed separately per month.

Related Bouncer articles on Cllimber

• Email verification for Klaviyo: How to clean lists and protect campaign deliverability
• Enterprise email verification
• Email verification for marketing teams
• Email verification for marketing teams at large B2C brands
• Automated CRM email list cleaning
• Bulk email verification for lists with 100,000+ contacts
• GDPR-compliant email verification for European businesses
• email verification software for marketing agencies
• email verification software for ecommerce stores