Copy page

Email verifiers

Migrate from MillionVerifier

This guide maps the MillionVerifier API (single verification v3, the bulk file API v2, and credits) to the Tomba Email Verifier and bulk verifier jobs. MillionVerifier API behavior checked on 2026-09-29 against the MillionVerifier API reference.

Before you begin

• Get your API key (ta_…) and secret (ts_…); see Authentication.
• Check what a verification costs in Credit costs and your plan's throttling in Limits by plan.
• Set your HTTP client timeout to at least 180 seconds. Tomba returns the finished result in the response.

Endpoint mapping

MillionVerifier uses two hosts, api.millionverifier.com and bulkapi.millionverifier.com. Tomba serves everything from api.tomba.io.

Authentication changes

MillionVerifier reads the key from the query string: api on the single and credits endpoints, key on the bulk endpoints. Tomba needs two headers, X-Tomba-Key and X-Tomba-Secret, and doesn't accept credentials in the query string:

Code
# MillionVerifier
curl "https://api.millionverifier.com/api/v3/?api=$MILLIONVERIFIER_API_KEY&email=jane.doe@stripe.com&timeout=10"

# Tomba
curl "https://api.tomba.io/v1/email-verifier?email=jane.doe@stripe.com" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY"

Tomba API keys expire; plan their rotation with Key expiry.

Parameter mapping

Response field mapping

MillionVerifier returns a flat object. Tomba nests the checks in data.email and lists the public pages where the address appears in data.sources. Field definitions are in Email verifier response.

Tomba also returns accept_all, disposable, gibberish, regex, smtp_provider, mx.records, and whois, which have no MillionVerifier counterpart.

Status mapping

Compare status case-insensitively. Each value is defined in Status values.

Error mapping

MillionVerifier returns errors with HTTP 200, as result: "error" and an error string on the single endpoint, or an error field on the bulk endpoints. Tomba returns an HTTP error status with an errors object, so check the status code instead:

Error responses don't consume credits. Every type is listed in Errors.

Bulk and async jobs

Code
curl -X POST "https://api.tomba.io/v1/bulk/verifier" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY" \
  -F "name=Newsletter list" \
  -F "file=@emails.csv;type=text/csv" \
  -F "email_field_index=0"

Tomba treats the first row of the file as a header. The launch, progress, and download requests are shown in Lifecycle. Row limits and daily job limits are in Limits, and a job is charged when you first download its results; see Billing.

Code example

This function replaces a call to /api/v3/ and returns MillionVerifier's result and resultcode for the address. It needs Node.js 18 or later.

Code
const TOMBA_HEADERS = {
    "X-Tomba-Key": process.env.TOMBA_API_KEY,
    "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY,
};

// Tomba status -> MillionVerifier [result, resultcode]
const RESULTS = {
    valid: ["ok", 1],
    accept_all: ["catch_all", 2],
    unknown: ["unknown", 3],
    disposable: ["disposable", 5],
    invalid: ["invalid", 6],
};

async function verify(email) {
    const url = new URL("https://api.tomba.io/v1/email-verifier");
    url.searchParams.set("email", email);
    const res = await fetch(url, { headers: TOMBA_HEADERS });
    const body = await res.json();
    if (body.errors) {
        // Unlike MillionVerifier, errors use HTTP status codes, such as 402 or 429.
        throw new Error(
            `${res.status} ${body.errors.type}: ${body.errors.message}`,
        );
    }

    const check = body.data.email;
    const [result, resultcode] =
        RESULTS[check.status.toLowerCase()] ?? RESULTS.unknown;
    return {
        email: check.email || email,
        result,
        resultcode,
        free: check.webmail,
    };
}

console.log(await verify("jane.doe@stripe.com"));

Cutover checklist

1. Store the Tomba key and secret as TOMBA_API_KEY and TOMBA_SECRET_KEY, send them as X-Tomba-Key and X-Tomba-Secret, and remove the api and key parameters from your URLs and logs.
2. Point single verifications at GET https://api.tomba.io/v1/email-verifier, drop timeout, and set a client timeout of at least 180 seconds.
3. Replace checks of result: "error" with HTTP status handling: 402, 422, 429 with Retry-After, 408, and 451.
4. Translate result and resultcode with the status mapping, comparing status case-insensitively.
5. Replace file uploads with verifier bulk jobs: create, launch, receive the webhook_url event instead of the file_ready webhook, and download the CSV.
6. Verify the same sample list with both services and compare the mapped results before you switch production traffic.