API keys

Every request carries a key in the Authorization header:

curl https://api.padimail.app/v1/account -H "Authorization: Bearer $PADIMAIL_API_KEY"

const pm = new PadiMail(process.env.PADIMAIL_API_KEY); // or new PadiMail("pm_live_…")

Keys in the query string are refused, so they don't end up in logs.

Kinds of keyCopy Anchor Link

Each key also has a permission:

• Full access: every endpoint.
• Sending only: send and batch, get an email, and cancel or reschedule its own emails. Anything else returns 403 forbidden. Use these on servers that only send.

A key can also be limited to one domain. It then can't send from any other (403 sender_not_allowed).

Create and revoke keysCopy Anchor Link

In the dashboard under API keys, or with a full-access key:

const key = await pm.apiKeys.create({ name: "Production server", permission: "sending_access" });
console.log(key.token); // shown only in this response
await pm.apiKeys.remove(key.id); // stops working within 60 seconds

curl -X POST https://api.padimail.app/v1/api-keys \
  -H "Authorization: Bearer $PADIMAIL_API_KEY" -H "Content-Type: application/json" \
  -d '{"name": "Production server", "permission": "sending_access"}'

Keep keys secretCopy Anchor Link

• Never put a key in a browser, mobile app or Flutter client. Anyone who opens the app can read it and send email as you. Call PadiMail from your server, and have your app call your server.
• Store keys in environment variables or a secrets manager, not in your repository.
• Use a separate sending-only key for each server, so you can revoke one without touching the others.
• If a key leaks, revoke it straight away and create a new one.