> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sendbaze.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an API key

> Keys authenticate every request. Create one in the dashboard, store it as an environment variable, and pick the scopes it needs.

**1. Open API keys in the dashboard**

Sign in at [dashboard.sendbaze.com](https://dashboard.sendbaze.com) and go to **API keys**. Owners, admins and developers can create keys.

**2. Choose a mode**

* **Test keys** start with `sk_test_`. They run every validation, return real-looking ids and never send, never touch your allowance and never use credits. Use them while you wire up your code and in CI.
* **Live keys** start with `sk_live_`. They send real email and SMS. Email goes from a [verified domain](https://docs.sendbaze.com/get-started/add-domain.md), or, for your first 100 emails to your own addresses, from the [shared test address](https://docs.sendbaze.com/get-started/test-without-a-domain.md).

**3. Choose scopes**

A key only does what its scopes allow. Give a server that only sends email `emails:send` and nothing else.

| Scope | Allows |
| - | - |
| `emails:send` | Send email and batches; manage templates and suppressions |
| `sms:send` | Send SMS and batches |
| `domains:write` | Add, verify and delete sending domains |
| `webhooks:write` | Create, change, test and delete webhook endpoints; replay deliveries |
| `read` | Read messages, templates, domains, suppressions, webhooks and usage |

**4. Copy the key once**

The full key is shown one time. Sendbaze stores only a hash, so a lost key must be replaced. Put it in an environment variable rather than in code:

```bash .env theme={"dark"}
SENDBAZE_API_KEY=sk_live_xxxxxxxx
```

## Use it

Send the key as a bearer token on every request.

```bash theme={"dark"}
curl https://api.sendbaze.com/v1/usage \
  -H "Authorization: Bearer $SENDBAZE_API_KEY"
```

> [!WARNING]
>
> Never ship a live key in a browser bundle or a mobile app. Call Sendbaze from your server, or from a route handler in frameworks such as Next.js, so the key stays private.

## Revoke a key

Revoke a key from the same page. Requests with it fail with `401 unauthorized` from the next call. The **Last used** column shows whether anything still relies on a key before you revoke it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.