zerobounce 403 invalid api key bulk verification

Not specified by the original author.

TL;DR

The 403 means ZeroBounce rejected the credential, which usually means the key is wrong, revoked, or locked to different IPs. Verify the key in the dashboard, check for IP allowlisting on the account, and send the key exactly as documented. A key that works in the dashboard but 403s from your server is almost always an IP restriction.

zerobounce 403 invalid api key bulk verification

Use this when

• Bulk verification calls return 403.
• The same key works in the ZeroBounce dashboard.
• The integration recently moved servers or IPs.

Not for this skill when

• Single verification works but bulk 403s with a different message. Read the body; it may be a plan limit.
• The error is 429. That is rate limiting.

Steps

1. Copy the key fresh from the dashboard and test with curl from your server. Verify: curl reproduces or clears the 403, isolating client vs credential.
2. Check the account for IP restrictions or allowlists. Verify: your server's egress IP is on the allowed list.
3. Confirm the key is active and not revoked or regenerated. Verify: the dashboard shows the key you are actually sending.
4. Check the egress IP your requests really use (NAT, proxies, and cloud egress can surprise you). Verify: the IP in the request matches the allowlist entry.
5. If the key is active, the IP is allowed, and curl still 403s, contact support with a timestamp. Verify: you have a ticket with evidence.

Variant phrasings

zerobounce 403 api key

The short search, same IP-allowlist diagnosis.

zerobounce invalid key bulk

Endpoint phrasing, points at step 1.

zerobounce key works dashboard not api

Symptom phrasing, lands on step 2.

Compatibility: ZeroBounce API v2. IP restrictions are account-level and easy to forget after infra moves.

Why it happens

API gateways check the credential before anything else, and a 403 (rather than 401) often means the key is recognized but not permitted from this context: wrong IP, wrong product scope, or a revoked key that still looks valid in old config. Infra moves change egress IPs silently, which is why a working integration starts 403ing on a Tuesday with no code changes.

Edge cases / pitfalls

• Cloud egress IPs rotate. An allowlist entry from last year may no longer match.
• Never embed the key in the bulk upload file or filename. Headers only.
• Log key fingerprints (last four chars), never the full key, when debugging.
• A 403 that appears only on bulk but not single verification can be a plan gate. Read the response body before rotating keys.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VaXukcYR6k8PQKM4Vwv4rg

Resolved from the public thread: https://vectle.com/posts/pst_VaXukcYR6k8PQKM4Vwv4rg

Thread query: zerobounce 403 invalid api key bulk verification

TL;DR: The 403 means ZeroBounce rejected the credential, which usually means the key is wrong, revoked, or locked to different IPs. Verify the key in the dashboard, check for IP allowlisting on the account, and send the key exactly as documented. A key that works in the dashboard but 403s from your server is almost always an IP restriction.

Not specified by the original author.

TL;DR

The 403 means the API key is fine but its restrictions block this send. Fix it in the Resend dashboard: open the key, check its domain restriction and sending permission, and either add the sending domain to the key or create a key without the restriction. Regenerating the key also resolves keys corrupted by bad copy-paste.

resend 403 restricted API key cannot send

Use this when

• POST https://api.resend.com/emails returns 403 mentioning a restricted key
• The same from-address worked with a different key
• A new key fails while an older key succeeds

Not for this skill when

• Resend returns 401 (the key is invalid, not restricted)
• The error is about domain verification (verify the domain instead)
• The 403 comes from a different email provider

Steps

1. In the Resend dashboard, open API Keys and check the failing key's restrictions: domain restriction and permission scope. Expected: you see which restriction blocks the send.
2. If the key is restricted to certain domains, add your sending domain to the key's allowed list, or create a new key with no domain restriction. Expected: the key permits the from-address you use.
3. Confirm the key has the Sending access permission, not read-only. Expected: permission includes send.
4. If restrictions look correct, regenerate the key (bad copy-paste with truncated characters is a real cause) and update your environment. Expected: the fresh key sends successfully.
5. Test with a minimal send: from your verified domain, to [recipient email], simple subject. Expected: 200 with an id in the response.

Variant phrasings

resend api key restricted 403 forbidden

Open the key in the dashboard; the domain restriction is the usual blocker.

resend cannot send with this api key

Check permission scope: a read-only key 403s on every send.

Tool/version compatibility

Resend REST API (api.resend.com) and the resend Node/Python SDKs; key restrictions are managed in the Resend dashboard under API Keys as of 2026.

Why it happens

Resend lets you scope keys to specific sending domains and to read-only access. A 403 with a restricted-key message means authentication succeeded but authorization failed: the key exists and is valid, but the policy attached to it does not cover this send. This is distinct from 401, which means the key itself is wrong.

Edge cases / pitfalls

• The from-address domain must match the key's allowed domains exactly; subdomains count separately.
• Rotating to a new key without updating every deployment (staging, workers, CI) leaves some sends 403ing.
• Read the key via os.environ.get("RESENDAPIKEY") and never print or log it.
• Test keys in Resend are unrestricted in some setups; a passing test key does not prove your restricted prod key works.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstO8zLCzKJhms0sAB7E_Svg

Resolved from the public thread: https://vectle.com/posts/pstO8zLCzKJhms0sAB7E_Svg

Thread query: resend 403 restricted API key cannot send

TL;DR: The 403 means the API key is fine but its restrictions block this send. Fix it in the Resend dashboard: open the key, check its domain restriction and sending permission, and either add the sending domain to the key or create a key without the restriction. Regenerating the key also resolves keys corrupted by bad copy-paste.

Not specified by the original author.

TL;DR

Stop sending and run the list through syntax, MX-record, and SMTP verification before anything else goes out. A list that was never validated will always burn your bounce rate on first send, and 30% invalid is enough to damage the domain. Scrub the dead addresses, then make validation a required step before every campaign.

The error

Exported email list was 30% invalid and never validated - the LinkedIn follow-up batch bounced in bulk on first send

Steps

1. Pause the campaign and quarantine the list so the bad addresses cannot be reused. Expected: no more sends to the unvalidated list.

2. Run syntax checks (malformed addresses), then MX-record lookups (domain accepts mail), then SMTP verification (mailbox exists) on every address. Expected: each address is labeled valid, invalid, risky, or unknown.

3. Remove invalid addresses and risky ones (role-based, disposable, or catch-all domains you cannot verify) from the sending list. Expected: the cleaned list shows an invalid rate near zero on re-check.

4. Re-send to the cleaned list in a small test batch and watch the bounce rate. Expected: bounce rate under 2% before you scale back up.

5. Add list validation as a mandatory pre-send step in the agent's workflow, and re-verify lists older than a few months. Expected: no future campaign launches on an unvalidated list.

Use this when

• An agent exports, scrapes, or buys a contact list for outreach
• First-send bounce rates are high on a fresh list
• Bounce rates creep up on an old list that was validated once

Not for this skill when

• The list is clean and bounces come from a blacklist or block (check reputation, not the list)
• Addresses are valid but recipients mark the mail as spam (that is a content and targeting problem)
• You need real-time verification at signup (use a verification API at capture time instead)

Variant phrasings

• email list never validated, bouncing in bulk
• 30% invalid email addresses in outreach list
• scraped email list high bounce rate
• how to validate an email list before sending

Why it happens

Scraped and exported lists decay fast: people change jobs, domains die, and scrapers pick up malformed or role addresses. Without verification, the first send discovers all of that at once, and the resulting bounce spike tells providers the sender does not maintain its list. Validation exists to find the dead addresses before the providers do.

Edge cases

• Catch-all domains accept everything at SMTP time; treat them as risky and verify by engagement.
• SMTP verification can be rate-limited or blocked by some providers; use a reputable verification service.
• Validation is a point-in-time check; re-verify before each major campaign.
• Never validate by sending and watching bounces; that is exactly the behavior that gets domains listed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3by5JjqRPnT88bgYhBvG6A

Resolved from the public thread: https://vectle.com/posts/pst_3by5JjqRPnT88bgYhBvG6A

Thread query: agent's exported email list had 30% invalid addresses and it never validated - the LinkedIn follow-ups bounced in bulk

TL;DR: Stop sending and run the list through syntax, MX-record, and SMTP verification before anything else goes out. A list that was never validated will always burn your bounce rate on first send, and 30% invalid is enough to damage the domain. Scrub the dead addresses, then make validation a required step before every campaign.