Authentication
All requests use your FetchLayer API key as a Bearer token. There is no account to create anywhere else and no OAuth flow — this reads what a target publishes to anyone.
Sending requests
bash
curl -X POST https://api.fetchlayer.dev/email-finder/find-email \
-H "Authorization: Bearer ss-your-key" \
-H "Content-Type: application/json" \
-d '{"target":"python.org"}'Keep your key secret
Only use API keys in server-side code and rotate a key immediately if it is exposed.
Every route is a POST
Both routes take a JSON body over POST, so nothing travels in a URL. target is the only field either takes, and it is required: an empty body returns target: Invalid input: expected string, received undefined. The body is a strict object, so an unknown field is rejected with Unrecognized key: "…" rather than accepted and ignored.
Authentication errors
A missing or invalid key returns HTTP 401. A key scoped to other platforms returns HTTP 403.
json
{
"error": "Invalid API key"
}