Credentials API

Credentials are API keys scoped to a sending domain with specific permissions.

Required permission: admin

---

List credentials

GET /api/v1/credentials

curl https://api.emitlo.com/api/v1/credentials \
  -H "Authorization: Bearer YOUR_API_KEY"

Response:

{
  "status": "success",
  "data": {
    "credentials": [
      {
        "id": 1,
        "label": "Production API Key",
        "username": "prod_abc123",
        "sending_domain": "yourdomain.com",
        "permissions": ["send", "stats"],
        "status": "active",
        "last_used_at": "2026-04-20T14:30:00Z",
        "created_at": "2026-01-10T09:00:00Z"
      }
    ]
  }
}

---

Create credential

POST /api/v1/credentials

Caution

The secret_key is returned only once at creation. Store it securely immediately — it cannot be retrieved again.

curl -X POST https://api.emitlo.com/api/v1/credentials \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "sending_domain_id": 1,
    "label": "Production API Key",
    "permissions": ["send", "stats"]
  }'

Field	Type	Required	Description
sending_domain_id	integer	✅	ID of the verified domain this credential is scoped to
label	string	✅	Human-readable name for this credential
permissions	array	✅	Array of permissions: send, stats, admin

Response (201):

{
  "status": "success",
  "data": {
    "credential": {
      "id": 2,
      "label": "Production API Key",
      "username": "prod_xyz789",
      "permissions": ["send", "stats"],
      "status": "active"
    },
    "secret_key": "ek_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  }
}

---

Delete credential

DELETE /api/v1/credentials/{id}

Permanently revokes a credential. Any requests using this key will immediately return 401.

curl -X DELETE https://api.emitlo.com/api/v1/credentials/2 \
  -H "Authorization: Bearer YOUR_API_KEY"