AddressFinder
DATA · DATA & ANALYTICS
Address autocomplete and verification for Australia, New Zealand, and worldwide, on their own key.
Connecting AddressFinder in practice
AddressFinder bills per successful Lookup rather than per API call — one Lookup each time a verified result comes back — so an agent that retries a failed match costs nothing and an agent that verifies the same address twice pays twice. The browser-style credential does not work at all until the calling domain is registered in the Portal.
Scopes that draw scrutiny
API key + secretThe server-to-server mode: the key goes in the query string and the secret in the Authorization header. AddressFinder’s own wording is "For server-to-server calls only, never expose your secret in client-side code."OAuth 2.0 client credentialsThe short-lived JWT route for teams with stricter security requirements, and it is only available on Business or Enterprise plans — so the auth model an enterprise review asks for is a pricing decision.
Rate limits
- AddressFinder states the service is "load tested to handle in excess of 10,000 requests per minute" and scales horizontally to meet demand.
- No per-key request ceiling is published; the documentation instead asks to be notified in advance of a high-volume launch.
- Usage is metered in Lookups — one per verified result returned — not in API calls.
Worth knowing
- Key-only auth requires the domain to be registered in the Portal first, with localhost included by default, so the same key that works locally fails from a new deployment host.
- Australia, New Zealand and International are separate country endpoints, so "verify this address" is a different URL depending on where the address is.
- The three auth modes are not interchangeable: moving from browser key to key-plus-secret changes where the credential lives in the request, and moving to OAuth changes the plan.
Checked against AddressFinder API overview (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put AddressFinder behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.