Authenticate with the SendByte API Using API Keys

SendByte authenticates every request using bearer API keys. Pass your key in the Authorization header on every request. Keys come in two modes: sandbox (sk_test_) for development and live (sk_live_) for production. Use the narrowest scope that meets your needs, and store every key in a secrets manager, never in source code.

Pass your API key

Include your API key as a bearer token in the Authorization header of every request:

Authorization: Bearer sk_test_...

Here is a minimal cURL example:

curl --request GET \
  --url https://api.sendbyte.africa/v1/emails \
  --header "Authorization: Bearer sk_test_YOUR_API_KEY"

import { SendByte } from "@sendbyte/node";

const client = new SendByte({ apiKey: process.env.SENDBYTE_API_KEY });

from sendbyte import SendByte

client = SendByte(api_key=os.environ["SENDBYTE_API_KEY"])

Never hard-code an API key in your source code or commit it to version control. Use environment variables or a dedicated secrets manager such as AWS Secrets Manager, HashiCorp Vault, or your hosting platform’s secret store.

Key modes

Every API key belongs to one of two modes. Use sandbox keys freely during development. They simulate the full email lifecycle without touching real inboxes or requiring a verified domain.

Mode	Prefix	Behavior
Sandbox	`sk_test_`	Simulated delivery, no domain required
Live	`sk_live_`	Real delivery, verified domain required

You cannot accidentally send live email with a sandbox key. The API rejects requests that mix modes, for example, using a sk_test_ key against a live-only endpoint.

Key scopes

When you create a key, you assign it one of three scopes. Scopes are enforced on every request and cannot be changed after creation. Create a new key if you need a different scope.

Scope	What it can do
`send_only`	Send emails only
`read_only`	Read emails, domains, webhook logs
`full_access`	All operations including key management

Use send_only for production application servers, read_only for dashboards and monitoring tools, and full_access only for administrative scripts or CI pipelines that need to rotate keys.

Key security

SendByte is designed so that a leaked key causes the least possible damage and can be remediated immediately:

Keys are stored as bcrypt hashes. SendByte never stores the raw key value, only a one-way hash. Not even support staff can retrieve your key after creation.
The full key is shown only once. Copy it immediately when you create a key. If you lose it, revoke it and create a replacement.
Multiple keys can be active at the same time. Run two overlapping keys during a rotation so you never experience downtime between deployments.
A key cannot revoke itself. This safeguard prevents you from accidentally locking yourself out. Always use a separate full_access key to perform revocations.

Key rotation

Rotate keys on a regular schedule or immediately after any suspected exposure. The recommended zero-downtime process is:

Create a replacement key with the same scope and mode.
Deploy the new key to your environment.
Verify the new key is working correctly.
Revoke the old key. Revocation takes effect immediately.

For full details on creating, listing, and revoking keys programmatically, see Manage API Keys.

Basics

Emails

Domains & Templates

Marketing

Webhooks & Keys

Suppressions

Authenticate with the SendByte API Using API Keys

Pass your API key

Key modes

Key scopes

Key security

Key rotation

​Pass your API key

​Key modes

​Key scopes

​Key security

​Key rotation

Pass your API key

Key modes

Key scopes

Key security

Key rotation