RefreshDocsConsole →

Dashboard

API keys

SEND vs FULL, live vs test keys, domain restriction, per-key rate limits, tokens that the console shows once, and one-click rotation with a grace period.

API keys lists each API key with its name, prefix (f5_live_ab… or f5_test_ab…), permission, mode, domain restriction, last-used time, creator and revocation state.

Creating a key

New key asks for:

  • Name — where the API key lives (drpromotions-prod).

  • Permission — SEND or FULL. SEND covers sends, message reads and cancels, contacts, subscriptions, broadcasts and events. FULL can also delete contacts. Members can mint SEND. Only an admin can mint FULL. See Authentication.

  • Test key — mints a f5_test_ key. The worker simulates each message from the recipient local part (bounce@, complaint@, ooto@). The worker delivers nothing and counts nothing; webhooks fire as normal. See Test mode. Use one test key per app for its integration tests. Every producer app gets one Live key and one Test key.

  • Requests per second (admins) — a cap for this key. Blank = the platform default of 10. Over the cap the API answers 429 rate_limited.

  • Domains — leave empty for all domains of the organization, or select the domains this API key may send from. Prefer one API key per app, restricted to the domain of that app.

The console shows the token (f5_live_ + 32 random characters) once in a copy box. The platform stores only the 12-character prefix and the SHA-256 hash. There is no way to reveal the token later.

SMTP username

The SMTP relay takes the id of the API key as the username and the token as the password. The list on this page shows the prefix, not the id. Settings → SMTP lists the id of every active API key next to its name, with a copy button.

Revoking

Revoke marks the API key as revoked. The row stays for the audit trail. The API then answers 401 unauthorized immediately. Admins can revoke any API key. Members can revoke the API keys that they created.

Rotation

Rotate mints a new API key with the same name, permission, mode, rate limit and domains. The console shows the new token once in a copy box. The old API key keeps working for 24 hours, then the API answers 401 unauthorized. The list shows an Expiring pill with the date on the old API key during that time, then Expired.

Admins can rotate any API key. Members can rotate the API keys that they created. An API key that is already expiring cannot rotate again; rotate its replacement instead.

To rotate an API key:

  1. Click Rotate on the row and confirm.
  2. Copy the new token and deploy it to the app.
  3. Confirm that the last used time of the old API key stops moving within 24 hours.
  4. Optional: click Revoke on the old API key to end the grace period early.

The platform updates the last-used time at most once a minute per API key.