Authentication

Every request carries a bearer token. Keys are 192 bits of random data, stored only as a SHA-256 hash, and shown to you exactly once.

bash

curl https://api.sreemail.com/v1/emails \
  -H "Authorization: Bearer sre_live_xxxxxxxxxxxx"

Key format

Keys are prefixed sre_live_ in production and sre_test_ otherwise. The prefix and last four characters are stored for display, so you can identify a key in a list without it ever being retrievable.

There is no recovery

A lost key cannot be shown again, because we do not store it. Revoke it and issue another. Revocation takes effect immediately — the cached credential is evicted rather than left to expire.

Scopes

Keys carry explicit scopes, and a key can never mint another key with scopes it lacks.

Scope	Grants
`emails:send`	Send mail, manage templates and suppressions
`emails:read`	Read the message log and event history
`domains:read`	List domains and inspect DNS record status
`domains:write`	Add and remove domains, manage API keys
`webhooks:read`	List webhook endpoints
`webhooks:write`	Create endpoints and replay events

Rate limits

Limits are applied per organization, with a burst allowance of ten times the sustained rate so a batch of notifications is not rejected for arriving at once.

Plan	Sustained	Burst
Free	10 req/s	100
Starter	20 req/s	200
Pro	50 req/s	500
Enterprise	100 req/s	1,000

Responses carry RateLimit-Limit and RateLimit-Remaining. A 429 includes Retry-After in seconds.