Create an API key
Every API request authenticates with a bearer API key:
Authorization: Bearer ss_...Create keys in the console under Platform → API Keys, or via the API itself
(POST /api-keys with a name). Keys look like ss_ followed by 48 hex characters and the full
key is shown once; only a hash is stored, so copy it immediately.
Permissions
Section titled “Permissions”| Permission | Access |
|---|---|
full_access (default) |
Every endpoint |
sending_access |
Only the /emails and /events surfaces, excluding inbound mail (/emails/received) |
Use sending_access keys anywhere a credential could leak sideways (CI, the
SMTP relay, third-party tools) so a compromised key can send but not read your
audience, domains, or settings.
Managing and rotating keys
Section titled “Managing and rotating keys”GET /api-keyslists your keys (name, prefix, permission; never the secret).DELETE /api-keys/{id}revokes a key immediately.
There is no in-place rotation: create a new key, deploy it, then delete the old one. Both keys work during the overlap, so rotation is zero-downtime.