Authentication

Send your API key as a bearer token in the Authorization header of every request:

Authorization: Bearer sk_live_...

The scheme is case-sensitive: Bearer with a capital B, one space, then the key.

A key belongs to one workspace and acts as that workspace. An email sent with it can only use that workspace's verified domains and templates, and it shows up in that workspace's Activity. To send for two workspaces, use a key from each.

Create a key

Owners and admins create keys in Settings > API Keys with Create API key. Name each key after the place it is used, for example Production or Billing worker, so you know what breaks when you revoke it.

Keys look like sk_live_ followed by 48 hexadecimal characters.

The list shows the first 12 characters of every key, its name, when it was created and when it was last used, so you can tell keys apart without seeing them. API keys walks through the page.

Keep keys secret

Anyone who holds a key can send email from your verified domains.

• Call the API from server-side code only. Never put a key in a browser bundle, a mobile app or anything else you ship to users.
• Load the key from an environment variable or a secret manager. Never commit it.
• Give each environment and each service its own key, so revoking one leaves the others working.

Revoke a key

Click Revoke next to the key in Settings > API Keys. Revocation takes effect immediately: the next request made with that key answers 401. It cannot be undone.

To rotate a key without downtime:

1. Create a new key.
2. Deploy it everywhere the old key is used.
3. Wait until Last used stops moving on the old key.
4. Revoke the old key.

Authentication errors

Both failures answer 401 Unauthorized with the usual error body:

A 401 never succeeds on retry. Fix the key, then send again.