Email validation for apps built with AI app builders
Apps built in Lovable, Bolt, Replit or v0 usually ship a signup form that checks one thing: whether the text looks like an email. ZapBounce adds the check that matters, a live SMTP handshake with the receiving server, through one call to POST /v1/verify from your app's backend.
You don't need to read an SDK or wire up a queue. Your builder writes one server function that sends the address, reads the result and decides what the form does next. Nothing is sent to the address, because the connection closes before DATA.
A generated form accepts anything shaped like an address
Ask a builder for a signup page and you'll get an input with type="email" and maybe a regex. Both check the shape of the string, so asdf@asdf.com, a disposable inbox and a typo like jane@gmial.com all get through.
Once your app has users, those rows cost you. Welcome emails bounce, password resets go nowhere, and free-trial abuse runs on throwaway addresses. Your sending domain collects the bounces, and the next real user's receipt is the message that lands in spam.
Fixing it later means cleaning a user table. Fixing it at the form is a single request per signup.
How the work gets done
The order that matters for apps built with AI app builders, rather than a generic checklist.
Keep the key on the server
Store your zb_live_ key as a secret in the backend your builder set up, such as a Supabase edge function or a Next.js API route, and call ZapBounce from there. A key pasted into front-end code is readable by anyone who opens the browser's dev tools.
Tell the builder exactly what to write
Prompt it with the contract: POST the address as JSON to https://api.zapbounce.com/v1/verify with an Authorization: Bearer header, then branch on the result field. Ask for a two-second timeout that lets the signup through, so a slow mail server never blocks a real user.
Branch on the four results
Accept valid. Show an error on invalid, and offer the did_you_mean suggestion when there is one. Accept catch_all and unknown, since either can belong to a real person, and flag the row for a later look. Read the disposable flag separately and block throwaway inboxes on a free trial if that's your rule.
Test with a sandbox key first
A zb_test_ key returns scripted results with no SMTP connections and never bills. Run your signup flow against it until every branch behaves, then swap in the live key.
The hard cases in apps built with AI app builders, and how they come back
What it costs
Every new account gets 100 free credits on signup, and 100 free credits every month after, with no card. That covers a new app's first signups. Past that, 1,000 checks cost $5. Sandbox calls, unknown results, errors and malformed input never cost a credit.
Every tier works the same way. Unknown results and duplicates are never billed, and credits do not expire.
Questions we get asked
Can I add email validation to a Lovable app?
Yes. Put your ZapBounce key in the app's backend secrets, have the builder write a server function that posts the address to /v1/verify, and call that function from the signup form. The form never sees the key.
Why is a regex not enough?
A regex checks that the text looks like an address and proves nothing about whether the mailbox exists. ZapBounce asks the receiving server with an SMTP handshake, so a typo at a real domain or a made-up mailbox comes back invalid.
Will the check slow my signup form down?
You set the ceiling. A two-second timeout that lets the signup through keeps the form fast even when a mail server is slow to answer, and the user never waits on ZapBounce longer than that.
Can my coding assistant call ZapBounce directly?
Yes. The zapbounce-mcp package is a small MCP server over /v1/verify and /v1/files, so an assistant that speaks MCP can check an address or a file while you build.
Try it on your own list first
100 free checks a month, no card. Run a sample and read the unresolved count before you decide anything.