Authentication

Every request authenticates with an API key sent as a Bearer token:

Authorization: Bearer tmk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys are prefixed with tmk_. The raw key is shown once, at creation — only a hash is stored, so it can never be retrieved again. Store it in a secret manager and rotate by creating a new key and revoking the old one.

Caution

Never expose an API key in client-side code, a browser, or a public repository. Keys act on behalf of your whole account within their granted scopes.

Scopes

Each key carries a set of scopes, and every endpoint requires a specific one. A key can only grant scopes its creator already holds.

Scope	Grants
email:send	Send email
email:read	Read email logs and analytics
template:read	Read templates
template:manage	Create, update, delete templates
domain:read	Read sending domains
domain:write	Add, verify, delete sending domains
smtp:read	Read BYOS SMTP config
smtp:write	Set, verify, delete BYOS SMTP config
suppression:read	Read the suppression list
suppression:write	Add and remove suppressions
webhook:read	Read webhook endpoints
webhook:write	Create, update, delete webhook endpoints
apikey:manage	Create and revoke API keys

Errors

A missing, malformed, or revoked key returns 401:

{ "error": "Invalid API key" }

Calling an endpoint your key lacks the scope for returns 403. When creating a key, requesting scopes beyond the caller’s own returns 400 with scope_exceeds_caller.

Managing keys

• POST /v1/api-keys — create a key (requires apikey:manage)
• GET /v1/api-keys — list keys (prefixes only, never the full key)
• DELETE /v1/api-keys/{id} — revoke a key