API keys

API keys authenticate REST and SMTP. The full secret is returned only at creation time.

Create API key

POST /v1/api-keys

Field	Type	Required	Description
name	string	Required	Label shown in the dashboard.
permission	string	Optional	`full_access`, `sending_only`, or `read_only`.
environment	string	Optional	`live` (default) or `test`.

{
  "id": "key_01",
  "name": "Production",
  "permission": "full_access",
  "environment": "production",
  "token": "xrl_prd_xxxxxxxx",
  "createdAt": "2026-07-12T08:00:00Z"
}

List keys

GET /v1/api-keys

Returns metadata only (id, name, permission, environment, last used). No secrets.

Revoke key

DELETE /v1/api-keys/{id}

Immediate revocation. In-flight requests with the key fail with 401.