An API key lets your code call the Inboxjot API and SMTP server. Send it as a bearer token in the Authorization header. Workspace admins manage keys in API Keys.
Create a Key
Click Create API Key, name the key and pick its permission. Copy the key when it appears. You see it only once.
Keys start with ibx_. Inboxjot stores only a hash of the secret part.
Permissions
| Permission | Can call |
|---|---|
| Sending access | POST /v1/emails, POST /v1/emails/batch and SMTP. |
| Full access | Every API route, including emails, contacts, events and attachments. |
A Sending access key on another route gets 403 with the message “This key can only send email”.
Restrict a Key
| Option | Effect |
|---|---|
| Domain | The key sends only from one verified domain. |
| Expires | The key stops working in 30 days, 90 days or 1 year. |
| IP allowlist | Up to 50 IP addresses. Other addresses get a 403. |
Set the domain and expiry when you create the key. Set the IP allowlist on the key page.
Roll a Key
Rolling a key makes a new secret and keeps the settings. Choose when the old key stops working: immediately, in 1 hour or in 24 hours. While the old key works, Expire Now on the key page stops it early.
Roll the key immediately if it leaked.
Revoke a Key
Revoke Key deletes the key. Requests that use it fail with 401 right away, and you cannot undo it. Emails sent with the key stay in your workspace.