Authentication
Secure your API requests with Bearer token authentication.
Creating API Keys
You can create API keys in two ways:
- From the API Keys dashboard
- Programmatically via
POST /v1/api-keys
Keys are shown once at creation. Store them securely. If you lose a key, revoke it and create a new one.
Bearer Token Format
Include your API key in the Authorization header of every request:
Header
Authorization: Bearer sf_live_your_api_key
All keys start with sf_live_ for production or sf_test_ for test mode.
Example Request
curl https://smtpfa.st/api/v1/emails \
-H "Authorization: Bearer sf_live_your_api_key" \
-H "Content-Type: application/json" \
-d '{"from":"[email protected]","to":["[email protected]"],"subject":"Test","html":"<p>Hello</p>"}'API Key Scopes
Scopes control what each key can access. When creating a key, select only the permissions you need.
| Parameter | Type | Required | Description |
|---|---|---|---|
| email:send | scope | No | Send emails and batch emails |
| email:read | scope | No | Retrieve email status and events |
| domain:read | scope | No | List and verify domains |
Keys created via the dashboard default to all scopes. Keys created via the API must specify scopes explicitly.
Rate Limit Headers
Every response includes rate limit headers so you can track your usage:
Response Headers
X-RateLimit-Limit: 100 X-RateLimit-Remaining: 97 X-RateLimit-Reset: 1712345678
See the Rate Limits page for details on limits per tier and how to handle 429 responses.
Authentication Errors
| Status | Meaning |
|---|---|
| 401 | Missing or invalid API key |
| 403 | Key does not have the required scope |