API Keys

All MisarMail API requests authenticate with an API key. Keys begin with msk_ and are scoped to specific actions.

Pass the key in the Authorization header on every request:

Authorization: Bearer msk_your_key_here

Example:

curl https://mail.misar.io/api/v1/send \
  -H "Authorization: Bearer msk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Each key is restricted to specific operations. Requests using a key without the required scope return 403.

Scope	Grants Access To
`send`	`POST /v1/send` — send transactional emails
`read`	Read emails, contacts, campaigns, templates
`write`	Create/update campaigns, templates, contacts
`contacts`	Full access to contacts and segments

Note: Keys are per-user. A key can only access resources owned by the user who created it.

Keys can be revoked anytime from Settings → API Keys. Revoked keys return 401 immediately.

Security Best Practices