Authentication and API keys
How to send your key, the two kinds of key, and keeping them safe.
Send your API key in the Authorization header as a Bearer token. The x-api-key header is accepted too. Keys start with irs_.
Authorization: Bearer irs_xxxxxxxxxFull access and sending only#
| Permission | Can call | Use it for |
|---|---|---|
| Full access | Every endpoint | Back-office tools and scripts |
| Sending access | POST /emails and POST /emails/batch only | Your application's servers |
A sending-access key can also be limited to chosen domains. Sending from any other domain then returns 401 restricted_api_key.
Creating, rotating and revoking#
- Create keys under API Keys in the console, or with
POST /api-keys. The full key is shown once. - Plans allow 5, 50 or 100 keys.
- Rotate in the console creates a new key with the same settings; revoke the old one when your servers use the new one.
- Revoking takes effect immediately. Each key's page shows when it was last used and its recent requests.
Important
Never put an API key in a browser, a mobile app or a public repository. Anyone with it can send email as you. If a key leaks, revoke it straight away.
Still stuck? Write to us and we'll reply by email.Contact ussupport@iresendly.com