API keys - mailerpath-docs

API keys authenticate machine-to-machine calls. They are simpler than OAuth but easier to leak—never embed them in browsers or mobile apps.

Create keys

Generate keys with descriptive labels and store them in a secrets manager—never in client-side code.

If your platform supports scoped keys, split read vs write access so a compromised read-only key cannot mutate data.

Rotate keys on a schedule or immediately after someone leaves the team with access.

Issue a new key, deploy everywhere, verify traffic, then revoke the old key—avoids hard cutovers at midnight.

Revoked keys stop working immediately. Update dependent services before revoking.

Document which cron jobs and CI pipelines use which key so rotation does not miss a dusty integration.