API keys

An API key lets your own software ask Mailyte to do things — look up a domain, list mailboxes, read delivery events — without a person signing in.

It is not the same as an SMTP credential. SMTP credentials send mail; API keys manage and read. If your goal is "my application sends email", you want Senders and SMTP credentials instead.

Keys live on the Developer page, alongside webhooks and third-party integrations.

Each key carries permissions, so a key used by a reporting script can be allowed to read without being allowed to delete. Give every key the narrowest set that lets it work.

A key can also have an expiry, or none. An expiry is a good habit: it turns "we should rotate that one day" into something that happens whether or not anyone remembers.

The key itself is shown once, when you create it. It is stored as a hash, so nobody — including Mailyte — can read it back to you later. If it is lost, create a new one and delete the old.

The list has a Last Used column, and it is not filled in by real usage yet. Treat it as blank rather than as evidence: a key showing nothing there may well be in daily use. Until that is wired up, name your keys well — the name is what tells you what a key is for.

The same page has a Third Party tab for connecting services like chat tools, where you connect and disconnect rather than manage keys yourself.

1. Go to Developer and open the API Keys tab.
2. Create a key and name it for the system that will use it — billing-sync, not key2.
3. Choose the narrowest permissions that let that system do its job.
4. Set an expiry unless you have a reason not to. Rotating on a known date beats discovering a five-year-old key in a repository.
5. Copy the key now. It is not shown again.
6. Store it wherever that system keeps its secrets — an environment variable or a secret manager, never in code you commit and never in a chat message.
7. Use one key per system, so revoking one never takes down three things you had forgotten shared it.

Your integration is refused. Check the key has not expired, and that it carries the permission for what it is attempting. A read-only key doing a write fails exactly like a wrong key.

You lost the key. It cannot be recovered. Create a replacement, update the system, delete the old one.

A key may have leaked. Delete it immediately — that stops it working — then create a replacement. Deleting first and apologising second is the right order.

You do not know what a key is for. Do not go by the Last Used column — it is not populated yet, so an empty value proves nothing. Search your own systems for the key name, and if you still cannot place it, rotate rather than delete: create a replacement, watch for something to break, then remove the old one.

Mail will not send with an API key. It never will. Sending needs an SMTP credential.

• Webhooks — Mailyte calling your systems
• Senders and SMTP credentials — for sending mail
• Go to Developer