Skip to main content
Each scope is a door on your key: open only what your integration needs, domain, send, read, or cancel.
Each scope unlocks one type of Email operation. Use only what your integration needs.

​
How to send the key

Recommended
Alternative
Each API Key belongs to one workspace. You cannot access another workspace with the same key.

​
Common combinations

Send only

email:send

Send and query

email:send, email:read

With scheduling

email:send, email:cancel

Full setup

email:domains:create, email:domains:list, email:send, email:read

Inbox + webhook

email:inbound:read, webhook email.received
An empty scope list on creation = ADMIN access. Always restrict in production.

​
Available scopes

Send immediate or scheduled email. The from domain must be VERIFIED.
  • List sent emails in the workspace
  • Query one send by id
With domainIds on the key, listing is limited to those domains.
Cancel queued or scheduled email. Only with QUEUED or SCHEDULED status. Credits are refunded.
List domains, view detail, and verify DNS status.
Register a new domain for DNS verification.
List and get received emails at GET /v1/email/inbound and GET /v1/email/inbound/:id. Requires Persist on the channel. With domainIds on the key, same domain rules as email:read. Webhook email.received for real-time.

​
Per-domain limit

If the key has domainIds configured:
  • Send — only from on those domains (403 DOMAIN_NOT_ALLOWED)
  • Sent list (email:read) — only messages on those domains
  • Inbound (email:inbound:read) — only received emails on those domains; invalid domainId → 400; domain not on key → 403; detail for other domain → 404
Empty list = any VERIFIED domain in the workspace.

​
Common errors

Check Authorization: Bearer sk_... and that the key wasn’t deleted in the dashboard.
Check route scope, domainIds on the key, and credits (PLAN_LIMIT_CREDITS).
Verify the from domain in the dashboard before sending.

​
Next steps