Authentication
Every API call carries one of your API keys. Keys belong to one brand and can't reach another brand's data.
API keys
Send the key in the Authorization header. Keys start with your brand's prefix, followed by _live_. We show a key once and store only a hash of it.
Authorization: Bearer yourapp_live_4f2a8cQ1bZ7nLx0Vt3RdSending and full access
| Permission | What it can do |
|---|---|
sending_access | Send emails. This is the default. It can be limited to one domain with domain_id. |
full_access | Everything in the API, including reading logs and managing domains, keys and webhooks. |
Give production apps a sending key. A leaked sending key can't read your data.
Rate limits
Each brand can make 10 send requests a second, across both streams. Above that we return rate_limit_exceeded with a 429 status and these headers: retry-after, ratelimit-limit, ratelimit-remaining and ratelimit-reset. Need more? Email us and we will raise it.
If a key leaks
If a stream suddenly sends 10 times its usual volume, we pause it and alert you. Revoke the key in your dashboard or with DELETE , then create a new one.