# API Keys

An API key lets your code call the Inboxjot API and SMTP server. Send it as a bearer token in the `Authorization` header. Workspace admins manage keys in API Keys.

## Create a Key

Click Create API Key, name the key and pick its permission. Copy the key when it appears. You see it only once.

```
INBOXJOT_API_KEY=ibx_…
```

Keys start with `ibx_`. Inboxjot stores only a hash of the secret part.

## Permissions

| Permission     | Can call                                                             |
| -------------- | -------------------------------------------------------------------- |
| Sending access | POST /v1/emails, POST /v1/emails/batch and SMTP.                     |
| Full access    | Every API route, including emails, contacts, events and attachments. |

A Sending access key on another route gets `403` with the message “This key can only send email”.

## Restrict a Key

| Option       | Effect                                               |
| ------------ | ---------------------------------------------------- |
| Domain       | The key sends only from one verified domain.         |
| Expires      | The key stops working in 30 days, 90 days or 1 year. |
| IP allowlist | Up to 50 IP addresses. Other addresses get a 403.    |

Set the domain and expiry when you create the key. Set the IP allowlist on the key page.

## Roll a Key

Rolling a key makes a new secret and keeps the settings. Choose when the old key stops working: immediately, in 1 hour or in 24 hours. While the old key works, Expire Now on the key page stops it early.

> Roll the key immediately if it leaked.

## Revoke a Key

Revoke Key deletes the key. Requests that use it fail with `401` right away, and you cannot undo it. Emails sent with the key stay in your workspace.