---
title: "API Keys"
description: "Authenticate the API with scoped, least-privilege keys."
url: https://www.unitpost.com/guides/api-keys
section: Guides
updated: 2026-07-31
---
# API Keys

## API Keys

> Authenticate the API with scoped, least-privilege keys.

API keys authenticate requests to the public v1 API. Create a key, choose a scope preset — Full, Sending, or Read only — and optionally narrow it to specific capabilities. The secret is shown once at creation; store it somewhere safe immediately.

> **Scope tightly:** Give each integration the least it needs — a server that only sends mail gets a Sending key, not Full. Keys can never hold privileged capabilities (managing other keys, the team, the workspace, or billing); those stay in the dashboard behind a human login.

Revoke a key the moment it's no longer needed or may have leaked; revocation is immediate. Pair keys with Webhooks to build a full integration: keys for outbound API calls, webhooks for inbound event notifications.

## Related

- [Webhooks](https://www.unitpost.com/guides/webhooks): Receive signed, real-time event notifications at your own endpoint.
- [Migration Assistant](https://www.unitpost.com/guides/migration): Move from Resend, SendGrid, Mailgun, Postmark, Brevo, or Loops with one read-only API key.
- [How it all fits together](https://www.unitpost.com/guides/overview): The contacts → segments → campaigns flow and the rules that keep it safe.