Authentication

The Send API authenticates with a project API key sent as a bearer token. The dashboard and management endpoints use a session cookie instead (you get that by signing in), so API keys are specifically for server-to-server calls to the Send API.

Bearer tokens

Send your key in the Authorization header on every request:

curl https://api.dev.messagepipe.dev/v1/email/send \
  -H "Authorization: Bearer mp_live_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "to": "you@example.com", "from": { "email": "hi@your-domain.com" },
        "subject": "Hi", "html": "<p>Hi</p>" }'

Keys are scoped to a single project. A key issued in one project cannot send through another (Projects).

Live and test keys

Every key carries a prefix that tells you what it does:

• mp_live_ : production traffic. Real provider calls, counts toward billable credits.
• mp_test_ : sandbox traffic. The request is validated and recorded, but it never reaches a provider and never consumes credits. The response status comes back as sent with "is_test": true, so you can exercise your integration end to end without sending anything real.

Use a test key in development and CI, a live key in production.

Scopes

A key only does what its scopes allow. The full set:

Bulk sends use the same send:<channel> scope as single sends; there is no separate bulk scope. A call whose key lacks the required scope returns 403 insufficient_scope.

Key lifecycle

Keys are managed in the dashboard under Settings, API keys.

• Create. The secret is shown once, at creation. Copy it then; it is never retrievable again.
• Rotate. Rotating issues a brand new secret and puts the old one into a 24-hour grace window, so you can roll the new key out before the old one stops working.
• Revoke. Revoking takes effect immediately.

Authentication errors

See the full list on the Errors page.