Skip to main content
Each scope is a door on your key: open only what your integration needs, domain, send, read, or cancel.
Each scope unlocks one type of Email operation. Use only what your integration needs.

​
How to send the key

Recommended
Alternative
Each API Key belongs to one workspace. You cannot access another workspace with the same key.

​
Common combinations

Send only

email:send

Send and query

email:send, email:read

With scheduling

email:send, email:cancel

Full setup

email:domains:create, email:domains:list, email:send, email:read
An empty scope list on creation = ADMIN access. Always restrict in production.

​
Available scopes

Send immediate or scheduled email. The from domain must be VERIFIED.
  • List sent emails in the workspace
  • Query one send by id
With domainIds on the key, listing is limited to those domains.
Cancel scheduled email. Only with SCHEDULED status. Credits are refunded.
List domains, view detail, and verify DNS status.
Register a new domain for DNS verification.

​
Per-domain limit

If the key has configured domainIds, it can only send with from addresses on those domains. A domain outside the list returns 403 (DOMAIN_NOT_ALLOWED). Empty list = any VERIFIED domain in the workspace.

​
Common errors

Check Authorization: Bearer sk_... and that the key wasn’t deleted in the dashboard.
Check route scope, domainIds on the key, and credits (PLAN_LIMIT_CREDITS).
Verify the from domain in the dashboard before sending.

​
Next steps