Skip to Content
API Keys

API Keys

All API requests to AutoSend must be authenticated using an API key. This guide covers how to create API keys and authenticate your requests.

Overview

AutoSend uses API Key authentication with Bearer tokens. Every API request must include your API key in the Authorization header. API keys are tied to a specific project and provide access to all resources within that project.

Creating an API Key

Follow these steps to generate a new API key from your AutoSend dashboard:

Step 1: Navigate to API Keys Settings

  1. Log in to your AutoSend dashboard
  2. Select your project from the project dropdown (if you have multiple projects)
  3. Go to Settings > API Keys in the sidebar

Step 2: Generate New API Key

  1. Click the “Generate API Key” button in the top-right corner
  2. Enter a descriptive name for your API key:
    • Use names that describe the purpose or environment (e.g., “Production”, “Staging”, “Development”, “Marketing Automation”)
    • This helps you identify and manage multiple keys
  3. Click “Generate”

Step 3: Save Your API Key Secret

After generation, you’ll see your API Key Secret displayed once:

Critical: Save Your API Key Immediately

For security reasons, the API key secret is only shown once during creation. You will NOT be able to view it again.

  • Copy the key immediately to your clipboard

  • Store it securely (password manager, environment variables, secrets management system)

  • Download the .txt file as a backup
  • Never commit API keys to version control (Git, SVN, etc.)
  • Never share your API key publicly or in client-side code

Your API key will look like this:

as_demo_your_api_key_here

API Key Format

AutoSend API keys follow this format:

as_[secret_string]
  • as - Prefix identifying AutoSend keys
  • secret_string - Cryptographically secure alphanumeric characters

Making Authenticated Requests

Include your API key in the Authorization header of every request using the Bearer authentication scheme:

HTTP Header Format

Authorization: Bearer YOUR_API_KEY

Example: cURL

curl -X POST https://api.autosend.com/v1/mails/send \
  -H "Authorization: Bearer as_demo_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "to": {
      "email": "[email protected]"
    },
    "from": {
      "email": "[email protected]"
    },
    "subject": "Test Email",
    "html": "<p>Hello World!</p>"
  }'

Example: JavaScript (Node.js)

const fetch = require("node-fetch");
 
const API_KEY = process.env.AUTOSEND_API_KEY;
 
async function sendEmail() {
  const response = await fetch("https://api.autosend.com/v1/mails/send", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      to: {
        email: "[email protected]",
      },
      from: {
        email: "[email protected]",
      },
      subject: "Test Email",
      html: "<p>Hello World!</p>",
    }),
  });
 
  const data = await response.json();
  console.log(data);
}
 
sendEmail();

Example: Python

import requests
import os
 
API_KEY = os.environ.get('AUTOSEND_API_KEY')
 
def send_email():
    url = 'https://api.autosend.com/v1/mails/send'
    headers = {
        'Authorization': f'Bearer {API_KEY}',
        'Content-Type': 'application/json'
    }
    payload = {
        'to': {
            'email': '[email protected]'
        },
        'from': {
            'email': '[email protected]'
        },
        'subject': 'Test Email',
        'html': '<p>Hello World!</p>'
    }
 
    response = requests.post(url, json=payload, headers=headers)
    print(response.json())
 
send_email()

Example: PHP

<?php
 
$apiKey = getenv('AUTOSEND_API_KEY');
 
$ch = curl_init('https://api.autosend.com/v1/mails/send');
 
$payload = json_encode([
    'to' => [
        'email' => '[email protected]'
    ],
    'from' => [
        'email' => '[email protected]'
    ],
    'subject' => 'Test Email',
    'html' => '<p>Hello World!</p>'
]);
 
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $apiKey,
    'Content-Type: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 
$response = curl_exec($ch);
curl_close($ch);
 
echo $response;
?>

Example: Go

package main
 
import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
    "os"
)
 
func main() {
    apiKey := os.Getenv("AUTOSEND_API_KEY")
 
    payload := map[string]interface{}{
        "to": map[string]string{
            "email": "[email protected]",
        },
        "from": map[string]string{
            "email": "[email protected]",
        },
        "subject": "Test Email",
        "html": "<p>Hello World!</p>",
    }
 
    jsonData, _ := json.Marshal(payload)
 
    req, _ := http.NewRequest("POST", "https://api.autosend.com/v1/mails/send", bytes.NewBuffer(jsonData))
    req.Header.Set("Authorization", "Bearer "+apiKey)
    req.Header.Set("Content-Type", "application/json")
 
    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()
 
    var result map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&result)
    fmt.Println(result)
}

Example: Ruby

require 'net/http'
require 'json'
 
api_key = ENV['AUTOSEND_API_KEY']
 
uri = URI('https://api.autosend.com/v1/mails/send')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
 
request = Net::HTTP::Post.new(uri.path)
request['Authorization'] = "Bearer #{api_key}"
request['Content-Type'] = 'application/json'
request.body = {
  to: {
    email: '[email protected]'
  },
  from: {
    email: '[email protected]'
  },
  subject: 'Test Email',
  html: '<p>Hello World!</p>'
}.to_json
 
response = http.request(request)
puts response.body

Managing API Keys

Viewing API Keys

In your dashboard under Settings > API Keys, you can see:

  • API Key Name - The label you assigned
  • API Key ID - A unique identifier for the key
  • Generated On - Creation date

Note: You cannot view the secret after creation. Only the key ID is visible.

Deleting API Keys

To delete an API key:

  1. Go to Settings > API Keys
  2. Find the API key you want to delete
  3. Click the three-dot menu icon
  4. Select “Delete”
  5. Confirm the deletion
Warning: Deletion is Immediate

When you delete an API key, it stops working immediately. Any applications or services using that key will start receiving authentication errors. Make sure to update your applications before deleting keys.

Best Practices for API Key Management

  1. Use Environment Variables

    # .env file
AUTOSEND_API_KEY=as_live_your_api_key_here

    Never hardcode API keys in your source code.

  2. Separate Keys for Different Environments

    • Create separate keys for development, staging, and production
    • Use descriptive names: “Production API Key”, “Staging API Key”
    • This allows you to rotate keys without affecting other environments

  3. Rotate Keys Regularly

    • Generate new keys periodically (every 90 days recommended)
    • Update your applications with the new key
    • Delete the old key after confirming the new one works

  4. Limit Key Exposure

    • Never commit keys to version control
    • Don’t include keys in client-side JavaScript
    • Use secrets management services (AWS Secrets Manager, HashiCorp Vault, etc.)
    • Add API keys to .gitignore: 
      .env
.env.local
config/secrets.json

Authentication Errors

401 Unauthorized

Error Response:

{
  "success": false,
  "message": "Unauthorized"
}

Common Causes:

  • Missing Authorization header
  • Invalid API key format
  • Expired or deleted API key
  • API key not properly prefixed with “Bearer ”

Solutions:

  • Verify the Authorization header is present
  • Check that your API key is correct and hasn’t been deleted
  • Ensure the format is: Authorization: Bearer YOUR_API_KEY
  • Confirm there’s a space after “Bearer”

403 Forbidden

Error Response:

{
  "success": false,
  "message": "Forbidden"
}

Common Causes:

  • API key doesn’t have access to the requested resource
  • API key belongs to a different project

Solutions:

  • Verify you’re using the correct API key for the project
  • Check that the resource (domain, template, etc.) exists in the project

Security Considerations

Keep Your API Keys Secret

API keys provide full access to your AutoSend account and should be treated like passwords:

  • Never share API keys in public forums, support tickets, or chat
  • Don’t include keys in screenshots or screen recordings
  • Revoke keys immediately if exposed
  • Use read-only keys when possible (future feature)

HTTPS Only

Always use HTTPS when making API requests. AutoSend APIs reject non-HTTPS requests to protect your API keys from interception.

Rate Limiting

API keys are subject to rate limits:

  • 2 requests per second per API key
  • 50 requests per minute per API key

Exceeding these limits returns a 429 Too Many Requests error. See the API Reference for more details.

Need Help?

If you’re having trouble with authentication, please contact support.

Next Steps

Campaigns
API Reference