Create and manage API keys

API keys authenticate requests from your own tools or scripts. Find them in Settings under API Keys.

Requirements

No plan is needed — API keys are open to every account. What a key does is paid in credits exactly like the same action in the app: an audit started through the API is 100 credits, and email sent through it is 25 credits per 1,000. When the balance runs out, requests that cost credits return an out-of-credits error (insufficient_credits).

Create a key

Click Create key and give it a Key name — something that identifies where it will be used, e.g. "Production". Choose the Mode and Scopes for what it should be allowed to do.

Scope keys as narrowly as the job requires. A key that can only read is a much smaller problem if it leaks.

Copy the key when it is shown. Use Copy to clipboard; the button confirms with Copied. Store it somewhere safe immediately — treat it like a password, because it is one.

Watching a key

Each key lists Created:, Last used: and Last IP:.

Last used is the useful one. A key with no recent use is a key you can probably delete, and every key you delete is one less thing that can leak. Last IP is worth a glance too — traffic from somewhere you do not recognise deserves investigation.

Statuses

• Active — in use.
• Rotating out — replaced by a new key but still accepted, so you can migrate without downtime.

Rotation is the right way to replace a key: create the new one, deploy it, watch Last used on the old key drop to nothing, then remove it. Deleting a live key outright breaks whatever was using it.

If a key leaks

Delete it immediately and create a replacement. Do not wait to find out whether it was used.

Next: open Settings → API Keys and check Last used on each key you already have.