API Keys

API keys authenticate public send API requests.

Use API keys after the domain has sending active. API keys do not replace domain activation; they only authenticate applications that need to send through already-enabled domains.

Key Format

New keys are long random secrets returned only at creation time:

your_api_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The full key is only returned when it is created. Arawa Mail stores the prefix and a SHA-256 hash, not the plaintext key.

Scope

Current API keys support the sending scope. A sending key can call the public email send endpoints but cannot sign in to the dashboard.

Domain Restrictions

An API key can be unrestricted across company domains or restricted to one website/domain. Restricted keys can only send from the configured domain.

For restricted keys, the from address must belong to the selected domain.

Last Used

Each successful authenticated API request updates the key's last_used_at timestamp.