API keys
Authenticate the Send API. Provision, scope, rotate, revoke.
API keys authenticate every call to the Send API. They are project-scoped, so
a key issued for Staging cannot send through Production.
Shape
mp_live_8C4E2A1F0D8C4E2A1F0D8C4E2A1F0D8C
└── mode ──┘└──────── 32-char base32 secret ──────┘mp_live_: production traffic. Counts toward billable credits.mp_test_: sandbox traffic. Free, capped, never delivers to real recipients.
The full secret is shown exactly once at creation. MessagePipe stores only an Argon2id hash; the secret cannot be recovered.
Scopes
| Scope | What it permits |
|---|---|
send:email | Call POST /v1/email/send and /send-bulk. |
send:sms | Call POST /v1/sms/send and /send-bulk. |
send:push | Call POST /v1/push/send and /send-bulk. |
send:chat | Call POST /v1/chat/send and /send-bulk. |
sends:read | Read send history (GET /v1/sends, GET /v1/sends/{id}). |
templates:read | Read templates via the Send API. |
analytics:read | Read analytics. |
A key may carry any combination. Minimum-privilege is good hygiene: a server
that only sends email needs only send:email. Bulk sends use the same
send:<channel> scope as single sends; there is no separate bulk scope.
Rotation
Rotation issues a new secret and puts the old one into a 14-day grace window. Both keys work until the window closes, so you can deploy the new secret with zero downtime. Cancel a rotation by revoking either the old or new key.
Authorization header
Authorization: Bearer mp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx