Creating and Managing API Keys

This guide shows you how to create a Sent API key, store it securely, verify that it authenticates, and rotate or revoke it. It assumes you have a Sent account with the Owner, Admin, or Developer role; these roles can open the API Keys page.

Create an API key

1. In the Sent Dashboard, open Development → API Keys in the sidebar, or go directly to the API Keys page.
2. Select Add API Key.
3. Name the key after where it will be used (for example, production-backend), then select Create Key.

The key appears in the table with its value masked. Use the copy control on the key value to copy the full key.

If you deploy to more than one environment, create a separate key for each (development, staging, production). All keys share the same UUID format; separate keys let you rotate or revoke one environment without touching the others.

The page header also displays your x-sender-id. Only legacy v1/v2 endpoints need it; v3 requests authenticate with the API key alone.

Store the key securely

Keep the key out of source code. Load it from an environment variable:

# .env — add this file to .gitignore
SENT_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

• Never commit keys to version control; a key in repository history stays exposed even after you delete it from the working tree.
• Never ship a key to a browser or mobile app. Call the API from your backend only.
• If each of your customers has their own Sent account and supplies their own key, build a per-request client instead of reading one key from the environment. See the integration blueprint's per-request authentication pattern.

Verify the key authenticates

Call the account endpoint with the new key:

curl https://api.sent.dm/v3/me \
  -H "x-api-key: $SENT_API_KEY"

A 200 response with your account profile confirms the key works. If you get a 401 with error code AUTH_002:

• Confirm you copied the full key and the header value is not empty (echo $SENT_API_KEY).
• Check the key's Status in the API Keys table; a disabled key is rejected.
• Confirm you are using the key for the intended environment.

If you retry a failing key repeatedly, 10 consecutive failures temporarily lock that credential and the API returns 429. Wait for the Retry-After period, then retry with a valid key. See the Authentication reference for the exact error responses.

Rotate a key

To rotate without downtime:

1. Create a replacement key as described in Create an API key.
2. Update SENT_API_KEY in your environment or secrets manager and redeploy.
3. Verify the new key with the /v3/me call from the previous section.
4. In the API Keys table, disable or delete the old key from the Actions column.

If a key is compromised, invert the order: delete the compromised key immediately, then deploy the replacement. Requests fail with 401 until the new key is live, which is preferable to leaving a leaked key active.

Related pages

• Authentication reference: the x-api-key header, response headers, and AUTH error codes.
• API authentication: why Sent authenticates with a single header-based key.
• Rate limits: per-account request limits.