Authentication & scopes
Give each integration precisely the access it needs, scoped to a single workspace.
Bearer authentication
Send an API key in the Authorization header. The API derives the tenant from the key. You may omit tenant_id on tenant routes; supplying a different tenant is rejected. Session requests must include tenant_id where the route requires it.
Authorization: Bearer YOUR_API_KEYAvailable scopes
Create separate keys for distinct services. Keys may only receive permissions the creating human has. Key creation and revocation require a signed-in owner, admin, or developer.
| Field / scope | Description | Requirement / access |
|---|---|---|
notifications:write | Send and cancel messages | Write |
notifications:read | Read message history | Read |
contacts:write | Create/update contacts, imports and lists | Write |
contacts:read | Read contacts, lists and suppressions | Read |
templates:read | Read versioned templates | Read |
domains:read | Read sending domains | Read |
campaigns:write | Create and operate campaigns | Write |
campaigns:read | Read campaign activity | Read |
metrics:read | Read delivery analytics | Read |
Rotate and revoke
Create a replacement key, deploy it to your service, confirm the integration works, then revoke the old key. Revocation prevents subsequent API access. The dashboard never displays the full stored secret again.
Session-only operations
Workspace administration, API key management, billing, team management, domain creation and Cloudflare DNS redirect preparation use authenticated dashboard sessions and role checks. API keys cannot perform platform administration.