> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailglyph.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create, scope, rotate, and revoke API key sets for your workspace

MailGlyph supports multiple API key sets per workspace. Each key set contains:

* **Private key** with `pk_` prefix (for `/v1/track`)
* **Secret key** with `sk_` prefix (for server-side/private endpoints)

Use separate key sets for different services so you can rotate or revoke access without affecting everything else.

> [!WARNING]
>
> Never expose `sk_` keys in browser code, mobile apps, or public repositories.

## Domain scope

Every key can be configured with one of two scopes:

* **All domains (default)**: the key can operate across all verified domains in the workspace.
* **Specific domains**: the key is restricted to an allowlist of workspace domains.

Domain scope is enforced for operations that use a sender domain, including `/v1/send` and SMTP sends. If a key is scoped to specific domains, the sender domain must be in that key's allowlist.

Creating a domain through `POST /v1/domains` requires an all-domain secret key. A domain-scoped secret key can retrieve, verify, or delete domains in its allowlist. An all-domain secret key can delete any domain owned by its workspace.

## Managing keys in the dashboard

From [**API Keys**](https://app.mailglyph.com/api-keys) in the workspace dashboard, you can:

* Create new keys
* Set key name and domain scope
* Edit name and domain scope
* Revoke individual keys

When a key is revoked, it stops authenticating immediately.

## Rotation and incident response

If you suspect a key leak:

1. Revoke the affected key.
2. Create a replacement key with the minimum required scope.
3. Roll out the new key to your services.

Create and revoke keys as needed to rotate credentials without changing unrelated integrations.

## SMTP notes

SMTP authentication uses secret keys. You can use any active `sk_` key, including scoped keys. Scoped secret keys can only send from allowed domains. See [SMTP](https://docs.mailglyph.com/guides/smtp.md).

To send through the API with the same credentials, see [Send Email API](https://docs.mailglyph.com/api-reference/public-api/sendEmail.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.