Copy page

Email verifiers

Migrate from NeverBounce

This guide maps the NeverBounce API v4.2 (single check, jobs, and account info) to the Tomba Email Verifier and bulk verifier jobs. NeverBounce API behavior checked on 2026-09-29 against the NeverBounce API reference.

Before you begin

• Get your API key (ta_…) and secret (ts_…); see Authentication.
• Check what a verification costs in Credit costs and your plan's throttling in Limits by plan.
• Set your HTTP client timeout to at least 180 seconds. A client timeout of about 10 seconds, as NeverBounce suggests, cuts off Tomba verifications that take longer.

Endpoint mapping

Replace the base URL https://api.neverbounce.com/v4.2 (or /v4) with https://api.tomba.io.

Authentication changes

NeverBounce reads the key from the key parameter. Tomba needs two headers, X-Tomba-Key and X-Tomba-Secret, and doesn't accept credentials in the query string or body:

Code
# NeverBounce
curl "https://api.neverbounce.com/v4.2/single/check?key=$NEVERBOUNCE_API_KEY&email=jane.doe@stripe.com"

# Tomba
curl "https://api.tomba.io/v1/email-verifier?email=jane.doe@stripe.com" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY"

Tomba API keys expire; plan their rotation with Key expiry.

Parameter mapping

Response field mapping

NeverBounce returns a flat object. Tomba nests the checks in data.email and lists the public pages where the address appears in data.sources. Field definitions are in Email verifier response.

Tomba also returns block, greylisted, gibberish, regex, smtp_provider, mx.records, and whois, which have no NeverBounce counterpart.

Status mapping

Branch on status: it has one value for each NeverBounce result, while result groups accept_all and unknown as risky. Compare status case-insensitively. Each value is defined in Status values.

Error mapping

NeverBounce reports failures in the status field of an HTTP 200 response. Tomba returns an HTTP error status with an errors object, so check the status code rather than a field in the body.

Error responses don't consume credits. Every type is listed in Errors.

Bulk and async jobs

Code
curl -X POST "https://api.tomba.io/v1/bulk/verifier" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Newsletter list", "list": "jane.doe@stripe.com\njohn.smith@shopify.com"}'

The launch, progress, and download requests are shown in Lifecycle. Row limits and daily job limits are in Limits, and a job is charged when you first download its results; see Billing.

Code example

This function replaces a call to single/check and returns NeverBounce's result value and the flags Tomba can supply. It needs Node.js 18 or later.

Code
const TOMBA_HEADERS = {
    "X-Tomba-Key": process.env.TOMBA_API_KEY,
    "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY,
};

// Tomba status -> NeverBounce result
const RESULTS = {
    valid: "valid",
    invalid: "invalid",
    disposable: "disposable",
    accept_all: "catchall",
    unknown: "unknown",
};

async function singleCheck(email) {
    const url = new URL("https://api.tomba.io/v1/email-verifier");
    url.searchParams.set("email", email);
    const res = await fetch(url, { headers: TOMBA_HEADERS });
    const body = await res.json();
    if (body.errors) {
        // Failures use HTTP status codes, for example 402, 429, or 451.
        throw new Error(
            `${res.status} ${body.errors.type}: ${body.errors.message}`,
        );
    }

    const check = body.data.email;
    const flags = [];
    if (check.mx_check) flags.push("has_dns_mx");
    if (check.webmail) flags.push("free_email_host");
    if (check.disposable) flags.push("disposable_email");
    if (check.accept_all) flags.push("accepts_all");
    return { result: RESULTS[check.status.toLowerCase()] ?? "unknown", flags };
}

console.log(await singleCheck("jane.doe@stripe.com"));

Cutover checklist

1. Store the Tomba key and secret as TOMBA_API_KEY and TOMBA_SECRET_KEY, send them as X-Tomba-Key and X-Tomba-Secret, and remove the key parameter from your URLs and logs.
2. Point single checks at GET https://api.tomba.io/v1/email-verifier and raise your client timeout to at least 180 seconds.
3. Replace checks of the status field with HTTP status handling: 402, 429 with Retry-After, 451, and 408.
4. Translate result and flags with the status mapping and flag table, comparing status case-insensitively.
5. Replace jobs with verifier bulk jobs: create with list or file, launch, receive the webhook_url event instead of the callback, and download the CSV.
6. Verify the same sample list with both services and compare the mapped results before you switch production traffic.