Get started
Authentication
Create API keys and call the API securely.
The REST API authenticates with a per-project API key (aem_…), sent as a
Bearer token. Each key is scoped to a single project.
Create a key
Open Settings → API keys in the dashboard and create a key. It's shown once and stored only as a hash — copy it immediately and keep it secret. Revoke a key anytime; revoked keys stop working instantly.
Use it
curl https://sendandretain.com/api/v1/emails \
-H "Authorization: Bearer aem_your_key" \
-H "Content-Type: application/json" \
-d '{ "to": "[email protected]", "template": "welcome" }'Scopes
Scopes are ranked — a key satisfies any requirement at or below its own tier:
- send — send email, upsert contacts, emit events. The default.
- full — everything in
send, plus reads and template / automation / segment / topic / suppression management. - admin — everything in
full, plus sending configuration: domains, senders, webhook registration, kill switch, daily cap, brand.
Give your application the lowest tier that works — usually send.
Keep keys server-side and load them from environment variables — an aem_ key
sends real email on your behalf.
For the full auth reference (header format, error codes), see API Reference → Authentication.