Errors

Every error response has the same shape:

{ "success": false, "error": "human readable message" }

Status	Meaning	Retry?
400	Malformed request	No, fix the request
401	Missing or invalid API key	No
402	Monthly quota exceeded, or account credit exhausted	Not until the period resets, or credit is added
403	Admin disabled, or embed origin not allowed	No
404	Not found, or a link that was never issued	No
410	Link expired or already used	No, issue a new link
429	Rate limited	Yes, after Retry-After
500	Our fault	Yes, with backoff

402 is not 429

A quota is a commercial ceiling, not a speed limit. It clears when the billing period rolls or when the plan changes, so retrying sooner will not help. The body tells you where you stand:

{
  "success": false,
  "error": "Monthly verification quota exceeded",
  "details": { "used": 100, "quota": 100, "periodResetsAt": "2026-09-01T00:00:00.000Z" }
}

Sandbox traffic is never blocked by a quota, so your developers keep working while live traffic is capped.

The same status is returned when a live session is created on an account with no credit left. A new account can run one live check before adding credit; the next one is refused like this until you top up:

{
  "success": false,
  "error": "Account credit exhausted. Top up to resume live verifications.",
  "code": "insufficient_credit",
  "details": { "balanceCents": 0, "currency": "usd", "outstandingCents": 125, "requiredCents": 1, "graceCents": 125 }
}

requiredCents is the exact amount that would clear the gate; the smallest top-up the dashboard accepts is $5. Sandbox traffic never needs credit either.

Link errors

410 distinguishes "already used" from "expired", and both messages are written to be shown to the recipient as-is. Every other rejection returns the same generic 404, deliberately: distinguishing "no such link" from "revoked link" would turn the endpoint into an oracle for probing token validity.