Authentication

Overview

SentinMail uses API keys to authenticate external integrations. Each API key is scoped to a single company and grants access to that company's resources — subscribers, templates, campaigns, and more.

Getting Your API Key

Log in to your SentinMail dashboard
Navigate to Settings > API Keys
Click Create API Key
Give it a descriptive name (e.g., "Production Server", "Staging")
Copy the key immediately — it's only shown once

Your API key looks like this:

Code

txt

1fm_abc123def456...

Warning

Store your API key securely. It cannot be retrieved after creation — if you lose it, you'll need to create a new one.

Making Authenticated Requests

Include your API key in the X-API-Key header on every request:

Code

bash

1curl -X GET "https://api.sentinmail.app/api/emails/templates/" \
2  -H "X-API-Key: fm_abc123def456..."

Info

When using an API key, you don't need to pass the `?company=` query parameter — the company is automatically determined from the key.

Example: Verify Your Key

A quick way to verify your API key is working — fetch your templates:

Code

bash

1curl -X GET "https://api.sentinmail.app/api/emails/templates/" \
2  -H "X-API-Key: YOUR_API_KEY"

Success (200):

Code

json

1{
2  "count": 5,
3  "next": null,
4  "previous": null,
5  "results": [
6    {
7      "id": "tmpl-uuid-here",
8      "name": "Welcome Email",
9      "subject": "Welcome to our platform!",
10      "created_at": "2026-03-15T10:00:00Z"
11    }
12  ]
13}

Invalid Key (401):

Code

json

1{
2  "detail": "Invalid API key."
3}

Key Security

Best Practice	Why
Never expose keys in frontend code	API keys are for server-side use only
Set an expiry date	Limits damage if a key is compromised
Use domain restrictions	Only allows requests from whitelisted domains
Use separate keys per environment	Isolate production from staging/dev
Rotate keys periodically	Reduces exposure window

Domain Restrictions

When creating an API key, you can optionally restrict it to specific domains. Requests from other origins will be rejected:

Code

json

1{
2  "name": "Production Only",
3  "allowed_domains": ["api.yourapp.com", "backend.yourapp.com"],
4  "expires_at": "2027-01-01T00:00:00Z"
5}

Rate Limits

API key requests share the same rate limits as authenticated requests. See Rate Limits & Errors for details.

Documentation

Authentication

Overview

Getting Your API Key

Making Authenticated Requests

Example: Verify Your Key

Key Security

Domain Restrictions

Rate Limits

Next Steps