Basics

Authentication

Every public endpoint is authenticated with an API key sent in the api-key HTTP header. Keys belong to a single brand.

The api-key header

Send your key in the api-key header on every request. This is the same header Brevo uses, so existing Brevo SDKs and integrations work unchanged. Authorization: Bearer <key> is accepted as an alternative.

HTTP header

api-key: sm_live_xxxxxxxxxxxxxxxxxxxxxxxx

For example, listing your templates:

GET /v3/smtp/templates

curl 'https://app.snappymails.com/v3/smtp/templates' \
  -H "api-key: $SNAPPYMAILS_API_KEY" \
  -H 'Accept: application/json'

Managing keys

Create and revoke keys on the API Keys & SMTP page of the portal. A key is shown in full only when it is created; afterwards only its prefix is visible.
Revoking a key takes effect immediately — requests using it get 401.
Use one key per application or environment so you can rotate them independently. The portal shows when each key was last used.
The same key, with the smtp:send permission, is used as the password for the SMTP relay.

Permissions

Keys can be limited to a set of permissions. A key with no permissions selected has full access.

Permission	Endpoints
`smtp:send`	POST /v3/smtp/email, POST /v1/tx/send, DELETE /v3/smtp/email/{id}, GET /v3/smtp/emailStatus/{id}, SMTP relay
`templates:read`	GET /v3/smtp/templates
`contacts:write`	GET/POST /v3/contacts, GET/PUT/DELETE /v3/contacts/{identifier}, GET/POST /v3/contacts/lists, POST /v3/contacts/lists/{listId}/contacts/add\|remove
`events:write`	POST /v3/events, POST /v1/events
`whatsapp:send`	POST /v1/whatsapp/send, GET /v1/whatsapp/messages/{messageId}

Authentication errors

Status	When
`401 unauthorized`	The api-key header is missing, malformed or the key was revoked.
`403 permission_denied`	The key is valid but lacks the permission the endpoint requires.
`403 email_not_verified`	The brand owner has not verified their email address yet; all send paths are blocked until they do.
`403 account_suspended`	Sending is disabled for the brand (for example a suspended or cancelled account).

Example

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{"code": "unauthorized", "message": "Key not found or authentication required"}

Treat keys like passwords

Never commit keys to source control or expose them in client-side code. If a key leaks, revoke it in the portal and create a new one.

PreviousGetting started Next Errors & rate limits