Authentication

PostStack uses API keys to authenticate requests. Include your key in the Authorization header of every request.

API Key Authentication

Pass your API key in the Authorization header using the Bearer scheme:

bash

curl https://api.poststack.dev/emails \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json"

With the SDK, pass your key when initializing the client:

typescript

import { PostStack } from '@poststack.dev/sdk';

const poststack = new PostStack('sk_live_...');

Creating API Keys

Create and manage API keys from the PostStack dashboard under Configuration → API keys. Your secret key is shown only once at creation -- store it securely.

Never expose your API key in client-side code, public repositories, or browser requests. Always use it server-side only.

Permission Levels

API keys support two permission levels:

Permission	Description	Access
`full_access`	Complete API access	Send emails, manage domains, contacts, templates, webhooks
`sending_access`	Send-only access	Send emails and view email status only

Domain-Scoped Keys

A key can optionally be restricted to one verified domain. It can then only send from addresses on that domain — any other from address is rejected with a 403. Leave domain_id out and the key may send from every domain on the team.

json

{
  "name": "Marketing emails only",
  "permission": "sending_access",
  "domain_id": "dom_abc123"
}

One restricted key per customer or per app is the safest default: a leaked key can only ever send as that one domain. If you run many domains under a single account, this is how you keep them isolated from each other. Deleting a domain immediately expires the keys restricted to it, so a key never widens its own reach.

SMTP Authentication

If you prefer to send emails via SMTP relay, use the following credentials:

Setting	Value
Username	`poststack`
Password	`sk_live_...` (your API key)