What is the maximum number of active API keys I can have?

There is no hard limit on the number of active API keys a single account can hold on Valid Email Checker. You can generate one, ten, or fifty — whatever fits how you organize integrations. The Developer page shows them all in a single table with masked previews, status badges, and per-key credits-used counters so the list stays readable.

Why hold more than one key

Splitting work across multiple keys is the pattern most engineering teams use, because it gives you precise rotation and revocation control without touching unrelated systems.

• Per environment — Production, Staging, Local dev. If a developer leaks their local key on a public repo, you regenerate that one without disrupting production.
• Per integration — Mailchimp middleware, Salesforce sync, Signup form. When you sunset Mailchimp, you delete its key and the other integrations carry on.
• Per teammate — useful for tracking who consumed how many credits during a sprint. Each row shows a separate credits_used figure.
• Per region or product line — if you run multiple SaaS products against the same VEC account, give each product its own key so the usage tables stay legible.

What is shared across keys

Multiple keys do not buy you extra capacity. Everything in the list below is enforced at the account level, not per key:

• Rate limits. All keys on one account share the 60-per-minute rolling window on /verify-single and /verify-bulk, plus the 10,000-per-day envelope. See API rate limits. Splitting traffic into five keys does not multiply your minute budget by five.
• Credit balance. Every key draws from the same credit buckets. See which credit bucket does the API consume from. One key burning through credits affects every other key on the account.
• Suspension. Account-level suspension applies to every key. A single key can also be suspended individually, but if abuse-protection escalates to the account, all keys stop authenticating.

What is NOT shared

• The friendly name (API Title).
• The created_at timestamp.
• The status (active, disabled, suspended) — you can disable one without touching the rest.
• The per-key credits_used counter, which lets you attribute spend back to the right integration.
• The masked key prefix shown in the table.

Cleaning up old keys

Old keys with zero recent traffic are a security liability — if one was exposed years ago without your knowledge, an attacker still has it. Once a quarter, scroll the bottom of your Developer table, look at the last-used dates, and disable or delete anything dormant. See revoking vs deleting for the right cleanup verb.

Next steps