Laravel

1 Keep the key on the server

MAILVET_KEY=mv_live_your_key

Set it wherever your server reads its environment. Never put it in client code.

2 Add it to the services config

config/services.php

'mailvet' => [
    'key' => env('MAILVET_KEY'),
],

3 Write the rule

app/Rules/MailvetEmail.php

<?php

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Http\Client\ConnectionException;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;

class MailvetEmail implements ValidationRule
{
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        try {
            $res = Http::withToken(config('services.mailvet.key'))
                ->connectTimeout(2)
                ->timeout(5)
                ->get('https://mailvet.dev/v1/check', ['email' => $value]);
        } catch (ConnectionException $e) {
            Log::warning('mailvet: no answer: '.$e->getMessage());
            return; // a signup shouldn't die because of us
        }

        if (! $res->successful()) {
            Log::warning('mailvet: HTTP '.$res->status());
            return;
        }

        $hint = $res->json('did_you_mean');
        if ($hint) {
            $local = substr($value, 0, strrpos($value, '@'));
            $fail("Did you mean {$local}@{$hint}?");
        } elseif ($res->json('verdict') === 'invalid') {
            $fail("That address can't receive mail.");
        } elseif ($res->json('verdict') === 'risky' && $res->json('disposable')) {
            $fail('Please use a permanent address, not a throwaway one.');
        }
    }
}

4 Use it on the signup request

app/Http/Controllers/SignupController.php

use App\Rules\MailvetEmail;

$validated = $request->validate([
    'email' => ['bail', 'required', 'email', 'unique:users', new MailvetEmail],
]);

bail stops at the first failure, so an address that's already taken doesn't spend a check.