Authentication
Authenticate each request with an API key as a bearer token in the Authorization header. Create keys in the dashboard under API Keys. You see a key only once, so store it as a secret.
Permissions
Can send email with POST /v1/emails and POST /v1/emails/batch. Other routes answer 403.
Can call every route in this reference, unless it is limited to one domain.
Key Rules
A key can be limited to one sending domain. It can then call only the email and sending routes: it sends only from that domain, sees only the emails and attachments of that domain, and answers 403 on every other route, such as Contacts, Events, Domains, Templates, Campaigns, Segments, Topics and Webhooks.
A key with an IP allowlist answers 403 when the request comes from another address.
A missing, revoked or expired key answers 401.