Authentication
Create API keys and call the API securely.
The REST API authenticates with a per-project API key (aem_…), sent as a
Bearer token. Each key is scoped to a single project.
Create a key
Open Settings → API keys in the dashboard and create a key. It's shown once and stored only as a hash — copy it immediately and keep it secret. Revoke a key anytime; revoked keys stop working instantly.
Use it
curl https://sendandretain.com/api/v1/emails \
-H "Authorization: Bearer aem_your_key" \
-H "Content-Type: application/json" \
-d '{ "to": "[email protected]", "template": "welcome" }'Scopes
Scopes are ranked — a key satisfies any requirement at or below its own tier:
- read — see messages, contacts and metrics. Changes nothing.
- write — everything in
read, plus template / contact / automation / segment / suppression management. - admin — everything in
write, plus sending configuration: domains, senders, webhook registration, kill switch, daily cap, brand.
Sending mail is a separate grant, not a tier: POST /api/v1/emails needs
write and the send grant. The dashboard mints that pair as Send + manage,
which is what most applications want. Manage only is the same write rung
with the grant withheld — it can edit and publish templates but never deliver.
Keep keys server-side and load them from environment variables — an aem_ key
sends real email on your behalf.
For the full auth reference (header format, error codes), see API Reference → Authentication.