API Keys

​

Overview

​

Key Types

• Project API Key (AS_...): Scoped to a single project. Use this for sending emails, managing contacts, templates, campaigns, and all day-to-day operations. This is the right choice for most integrations.
• Account API Key (ASA_...): Cross-project scope. Use this when you need to programmatically create, update, or delete projects - for example, when building a multi-tenant platform. All requests made with an Account API Key require an x-project-id header to specify the target project, except when creating a new project.

​

Creating an API Key

1

Navigate to API Keys

Go to Account > API Keys from the sidebar. Click the “Generate Key” button.

2

Generate a New API Key

A modal will open where you:

1. Enter a descriptive name (e.g. Production, Staging, Multi-tenant Service)
2. Select the key type: Account API Key or Project API Key
3. If you selected Project API Key: choose which project this key belongs to

Click “Generate”.

3

Save Your API Key Secret

After generation, your API Key Secret is shown once:

For security reasons, the API key secret is only shown once during creation. You will NOT be able to view it again.

• Copy the key immediately to your clipboard
• Store it securely in a password manager or secrets vault
• Download the .txt file as a backup
• Never commit API keys to version control
• Never share your API key publicly or in client-side code

​

API Key Formats

ASA_[secret_string]   ← Account API Key
AS_[secret_string]    ← Project API Key

• ASA: Prefix for Account-scoped keys
• AS: Prefix for Project-scoped keys
• secret_string: Cryptographically secure alphanumeric characters

​

Making Authenticated Requests

​

Project API Key

Authorization: Bearer AS_your_project_api_key

curl -X POST https://api.autosend.com/v1/mails/send \
  -H "Authorization: Bearer AS_your_project_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "to": {
      "email": "[email protected]"
    },
    "from": {
      "email": "[email protected]"
    },
    "subject": "Test Email",
    "html": "<p>Hello World!</p>"
  }'

​

Account API Key

Authorization: Bearer ASA_your_account_api_key
x-project-id: your_project_id

curl -X POST https://api.autosend.com/v1/mails/send \
  -H "Authorization: Bearer ASA_your_account_api_key" \
  -H "x-project-id: your_project_id" \
  -H "Content-Type: application/json" \
  -d '{
    "to": {
      "email": "[email protected]"
    },
    "from": {
      "email": "[email protected]"
    },
    "subject": "Test Email",
    "html": "<p>Hello World!</p>"
  }'

​

Choosing the Right API Key

• Use a Project API Key for everyday operations: sending emails, managing contacts, templates, campaigns, and webhooks within a specific project. This is the right key for most integrations.
• Use an Account API Key only when managing projects themselves - for example, when building a multi-tenant platform that automatically provisions new projects for each of your customers.

​

Managing API Keys

​

Viewing API Keys

• API Key Name: the label you assigned
• Type: Account or Project
• Project: the associated project (Project API Keys only)
• Generated On: creation date

​

Deleting API Keys

1. Go to Account > API Keys
2. Find the key you want to delete
3. Click the trash icon
4. Confirm the deletion

​

Best Practices for API Key Management

1. Use Environment Variables
   # .env file
   AUTOSEND_API_KEY=AS_your_project_api_key
   AUTOSEND_ACCOUNT_API_KEY=ASA_your_account_api_key
   AUTOSEND_PROJECT_ID=your_project_id
   
   Never hardcode API keys in your source code.
2. Separate Keys for Different Environments
   • Create separate Project API Keys for development, staging, and production
   • Use descriptive names: Production, Staging, Development
   • This allows you to rotate keys without affecting other environments
3. Rotate Keys Regularly
   • Generate new keys periodically (every 90 days recommended)
   • Update your applications with the new key
   • Delete the old key after confirming the new one works
4. Limit Key Exposure
   • Never commit keys to version control
   • Don’t include keys in client-side JavaScript
   • Use secrets management services (AWS Secrets Manager, HashiCorp Vault, etc.)
   • Add API keys to .gitignore:
     .env
     .env.local
     config/secrets.json
     

​

Authentication Errors

{
	"success": false,
	"message": "Unauthorized"
}

{
	"success": false,
	"message": "Forbidden"
}

​

Keep Your API Keys Secret

• Never share API keys in public forums, support tickets, or chat
• Don’t include keys in screenshots or screen recordings
• Revoke keys immediately if exposed

​

Rate Limiting

• 2 requests per second per API key
• 50 requests per minute per API key