Skip to main content
The REST API authenticates with an API key sent in the Authorization header as a Bearer token:
Your key is a string that starts with mk_. Send the whole string exactly as issued.

​
Creating a key

Create and manage keys in the dashboard under API keys. Each key is associated with a domain you’ve verified.
The key is shown only once, when it is created. Store it somewhere safe (a secrets manager or environment variable). If you lose it, create a new key and delete the old one.

​
Using a key

Never embed a key in client-side code, a mobile app, or a public repository. Anyone with the key can send on your behalf, and read its domain, organization, allowlist and plan. Keep it server-side and inject it from the environment:
A missing, malformed, or unknown key is rejected with 403 invalid_api_key. See Errors.

​
Checking a key

GET /api-keys/me returns the key a request authenticates with: its domain, organization, source-IP allowlist, plan and current send-quota usage. Call it to confirm a key works before your first send.
The key is checked exactly as a send checks it. A key that could not send, because it is suspended, used from outside its allowlist, or tied to a domain that cannot send, gets the same 403 invalid_api_key. The request counts as a use of the key, and the plan and quota figures can be up to 30 seconds old.