Authentication
API keys, scopes, and what a key can be limited to.
Every request carries a bearer token: Authorization: Bearer sk_live_…. Keys are created in the dashboard under API keys, shown once, and stored only as a hash — if you lose one, revoke it and make another.
Scopes
A key carries only the scopes you grant it. A key that only sends transactional mail has no business reading your contact list, and scoping it accordingly limits what a leak costs you.
| Scope | Allows |
|---|---|
| emails:send | Send, schedule, cancel |
| emails:read | Read the message log and event timelines |
| threads:read | Read conversations and inbound replies |
| domains:read / domains:write | List and manage sending domains |
| contacts:read / contacts:write | Read and import contacts |
| broadcasts:read / broadcasts:write | Read and send campaigns |
| templates:read / templates:write | Render and manage templates |
| webhooks:read / webhooks:write | Manage event subscriptions |
Idempotency
POST requests accept an Idempotency-Key header. Replaying the same key within 24 hours returns the stored response rather than acting again, and the response carries Idempotent-Replay: true so you can tell.
Next: Sending