Authentication

The API authenticates with a bearer API key. Keys are scoped, shown once, and stored only as a hash.

Bearer keys

Every request to the sending API carries an Authorization: Bearer header with an API key. Keys begin with am_live_ and are created in the dashboard under Settings → API keys.

shell
curl https://api.mail.atrix.dev/v1/emails/<id> \
  -H "Authorization: Bearer am_live_xxxxxxxxxxxxxxxxxxxxxxxx"

The full key is returned once, at creation. Only a SHA-256 hash and the short prefix are stored — we cannot show it again, so save it immediately. Lost a key? Revoke it and create a new one.

A key grants sending rights for your whole organization. Keep it server-side, rotate periodically, and revoke any key that may have leaked. Requests with a missing, malformed, or revoked key return 401 unauthorized.

Scopes

Each key is granted one or more scopes. A request needs the scope for the operation it performs, or it is rejected with 403 forbidden.

ScopeGrants
email.sendSend, cancel, and reschedule email.
emails.readLook up a sent email and its delivery events.
domains.readList domains and read their DNS records.
domains.writeAdd, update, verify, and delete domains.
audiences.readList audiences and their contacts.
audiences.writeCreate audiences; add, import, and delete contacts.
broadcasts.readList broadcasts and read their counters.
broadcasts.sendCreate, send, and delete broadcasts.
templates.readList and read templates.
templates.writeCreate, update, and delete templates.
analytics.readRead deliverability stats and the activity log.
mailboxes.readList mailboxes, aliases, and connection settings.
mailboxes.writeCreate, update, and delete mailboxes and aliases.
webhooks.readList endpoints and their delivery attempts.
webhooks.writeRegister, test, disable, and delete endpoints.
*All scopes. Only organization admins/owners may create a * key.

emails.send is accepted as an alias of email.send. Grant the narrowest set a key needs — a key that only sends should not carry emails.read, and a reporting integration wants analytics.read alone.

What API keys can access

Everything under /v1 is key-authenticated:

PathScope
/v1/emailsemail.send / emails.read
/v1/domainsdomains.read / domains.write
/v1/audiencesaudiences.read / audiences.write
/v1/broadcastsbroadcasts.read / broadcasts.send
/v1/templatestemplates.read / templates.write
/v1/mailboxesmailboxes.read / mailboxes.write
/v1/aliasesmailboxes.read / mailboxes.write
/v1/webhookswebhooks.read / webhooks.write
/v1/analytics/deliverabilityanalytics.read
/v1/activityanalytics.read

API-key management, and changing an existing mailbox's password, remain dashboard-only (session-authenticated) — a key must never be able to mint another key or take over a mailbox. The TypeScript SDK and the MCP server both cover the whole key-authenticated surface.

Errors

StatusCodeMeaning
401unauthorizedMissing Authorization header, or an invalid/revoked key.
403forbiddenThe key is valid but lacks the required scope.
403org_suspendedThe organization is suspended from sending.
429rate_limitedOver the per-key platform limit (60 writes / 600 reads per minute) or the plan's send budget. Carries Retry-After.