API keys & security
An API key is a credential — treat it like one. Climails keys are scoped, can be locked to specific IPs, rate-limited and given an expiry, so even a leaked key is contained. The full secret is shown once; only a hash is stored.
What you'll need
- Admin access to create or revoke keys
- A secret manager to store the key
Create a key
- 1
Open Settings → API keys → “Create”
Name the key for where it'll be used (e.g. “orders-backend”).
- 2
Copy it once
The full key is shown only at creation in the form sb_live_<prefix>.<secret>. We store only a hash — it can never be shown again.
- 3
Store it safely
Put it in your secret manager, never in source control or a frontend bundle.
Lock it down
- Scopes — grant only what the key needs (e.g. messages:send, contacts:write). A read-only integration never gets write access.
- IP allowlist — restrict the key to your server's IPs so it's useless from anywhere else.
- Rate limit — cap requests per minute to contain abuse and runaway loops.
- Expiry — set expires_at so short-lived integrations clean themselves up.
Monitor and rotate
- last_used_at shows whether a key is still in use — safe to retire the ones that aren't.
- Revoke instantly if a key leaks; revoked_at takes effect immediately and the key stops working.
- Rotate by creating the new key, deploying it, then revoking the old one — no downtime.
Frequently asked questions
I lost my key — can I see it again?
No. Only a hash is stored, so the secret can't be retrieved. Create a new key and revoke the old one.
How do I limit what a key can do?
Assign scopes at creation. A key with only messages:send can't read contacts or change settings.
How do I rotate without downtime?
Create the replacement, deploy it everywhere, then revoke the old key once last_used_at stops moving.
Start sending in minutes
Create a free account, connect your domain and reach your audience across every channel — no credit card needed.
Free plan forever · No credit card required · Set up in minutes