> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Scopes

> Email channel permissions: send, query, cancel scheduled sends, and manage domains.

<Tip>
  Each scope is a **door** on your key: open only what your integration needs, domain, send, read, or cancel.
</Tip>

Each **scope** unlocks one type of Email operation. Use only what your integration needs.

## How to send the key

**Recommended**

```http theme={null}
Authorization: Bearer sk_live_your_key_here
```

**Alternative**

```http theme={null}
x-api-key: sk_live_your_key_here
```

<Info>
  Each API Key belongs to **one** workspace. You cannot access another workspace with the same key.
</Info>

## Common combinations

<CardGroup cols={2}>
  <Card title="Send only" icon="paper-plane">
    `email:send`
  </Card>

  <Card title="Send and query" icon="magnifying-glass">
    `email:send`, `email:read`
  </Card>

  <Card title="With scheduling" icon="clock">
    `email:send`, `email:cancel`
  </Card>

  <Card title="Full setup" icon="globe">
    `email:domains:create`, `email:domains:list`, `email:send`, `email:read`
  </Card>
</CardGroup>

<Warning>
  An **empty** scope list on creation = **ADMIN** access. Always restrict in production.
</Warning>

## Available scopes

<AccordionGroup>
  <Accordion title="email:send">
    Send immediate or scheduled email. The `from` domain must be **VERIFIED**.
  </Accordion>

  <Accordion title="email:read">
    * List sent emails in the workspace
    * Query one send by id

    With **domainIds** on the key, listing is limited to those domains.
  </Accordion>

  <Accordion title="email:cancel">
    Cancel scheduled email. Only with `SCHEDULED` status. Credits are refunded.
  </Accordion>

  <Accordion title="email:domains:list">
    List domains, view detail, and verify DNS status.
  </Accordion>

  <Accordion title="email:domains:create">
    Register a new domain for DNS verification.
  </Accordion>
</AccordionGroup>

## Per-domain limit

If the key has configured **domainIds**, it can only send with `from` addresses on those domains. A domain outside the list returns **403** (`DOMAIN_NOT_ALLOWED`).

Empty list = any **VERIFIED** domain in the workspace.

## Common errors

<AccordionGroup>
  <Accordion title="401: missing, invalid, or revoked key">
    Check `Authorization: Bearer sk_...` and that the key wasn't deleted in the dashboard.
  </Accordion>

  <Accordion title="403: missing scope, domain not allowed, or plan limit">
    Check route scope, `domainIds` on the key, and credits (`PLAN_LIMIT_CREDITS`).
  </Accordion>

  <Accordion title="400: DOMAIN_NOT_VERIFIED">
    Verify the `from` domain in the dashboard before sending.
  </Accordion>
</AccordionGroup>

## Next steps

* [Quick Start](/en/emails-api/como-funciona/quick-start)
* [Webhook events](/en/emails-api/como-funciona/eventos-do-webhooks)
* [API Keys guide](/en/guides/api-key/index)