Authentication

Every request carries an API key in the Authorization header:

Authorization: Bearer sk_...

The workspace (tenant) is ALWAYS derived from the token, never from a request parameter.

Scopes

Keys carry granular scopes, or * for full access. The main ones:

• email:send, messages:send
• contacts:read, contacts:write
• domains:write, events:write
• automations:read, automations:write
• campaigns:read, campaigns:write
• inbox:read, inbox:write, inbox:send
• webhooks:read, webhooks:write
• commerce:read, commerce:write
• utm:read, integrations:write

A :read scope is implied by its :write counterpart: a key with campaigns:write can also read campaigns, without needing both.