do.dev

API Keys

Create, name, and revoke Send API keys in the dashboard

API keys are managed in the send.dev dashboard. There is no REST endpoint for creating or listing keys; that is deliberate, so a leaked key cannot mint more keys.

Create a key

  1. Sign in at send.dev and open API Keys.
  2. Click Create key.
  3. Give it a descriptive name, such as production-api or staging-worker. The name appears in the dashboard and in usage history; it is never sent to recipients.
  4. Copy the key. It is shown once. If you lose it, create a new key and revoke the old one.

Keys look like do_live_ followed by a random string. The key is stored hashed; send.dev cannot show it to you again.

Use a key

Send it as a bearer token on every request:

Authorization: Bearer do_live_...

The X-API-Key header is also accepted. See Authentication.

Revoke a key

In API Keys, choose the key and click Revoke. The key stops working within a minute. Requests that still use it receive 401 unauthorized.

Revoking a key does not affect queued or in-flight email; anything already accepted with a 202 still delivers.

Rotate a key

  1. Create a new key.
  2. Deploy it to your service.
  3. Confirm the new key is in use (the Last used column in the dashboard updates on each request).
  4. Revoke the old key.

Because there is no downtime between steps 2 and 4, rotation never needs a maintenance window.

Legacy sk_live_ keys

Keys issued before the platform migration start with sk_live_. They still authenticate. They cannot be created anymore; when you next rotate, the replacement will be a do_live_ key.

What a key can do

A key acts as your whole account: it can send from any verified domain or sender on the account, manage domains and templates, and read email history. Scope keys to purpose by creating one per service, and keep them out of client-side code. There is no way to restrict a key to a single domain today.