Skip to main content
Every request carries an API key in the Authorization header:
A missing, unknown or revoked key returns 401 with the code missing_api_key or invalid_api_key.

​
Test and live keys

Use test keys in development and CI. The response has the same shape in both modes; test_mode tells you which one you used.

​
Scopes

Each key carries scopes that limit what it can do. New keys get the defaults. A call outside a key’s scopes returns 403 with the code missing_scope.

​
Managing keys

You can hold up to 20 active keys per team. Create one per app or environment, so you can revoke a leaked key without touching the others. Revoking takes effect within a minute.
Keep keys on your server. Anyone with a live key can send email from your verified domains and spend your credits.