Authentication

All endpoints (except public tracking) require an API key sent as a Bearer token.

Bearer token

Authorization: Bearer xrl_prd_xxxxxxxx

A missing or invalid key returns 401 unauthorized:

{
  "error": {
    "type": "unauthorized",
    "message": "Invalid API key"
  }
}

Scope	Access
`full_access`	All endpoints (create, send, delete, read).
`sending_only`	Send + read sends/broadcasts; domains/audiences/contacts read-only.
`read_only`	All GET only; no create, send, or delete.

SMTP submission uses the same API key (username apikey, password = key). Keys with read_only cannot SMTP send.