Sendbound API Reference

Project-scoped API operations use secret keys in the Authorization header. Account/security operations and public-token flows use the distinct authentication schemes shown in the generated API catalog.

Project keys versus user sessions

Secret project keys do not authorize account ownership, membership administration, enterprise identity configuration, or API-key administration. Those operations require the dashboard user's next_token session cookie. Session routes that also select a project require X-Project-Id, as shown in the API catalog.

Public tracking keys cannot read private project data. Preference/unsubscribe links and provider callbacks retain their own token/signature authentication.

Creating an API key

Open your Sendbound dashboard.
Navigate to Developer → API Keys.
Click Create key, give it a name, and copy the plaintext value.

⚠

The plaintext key is shown once at creation time. Store it securely — you cannot retrieve it again.

Sending authenticated requests

Pass your key as a Bearer token:

Authorization: Bearer sk_live_your_key_here

cURL

curl https://api.sendbound.com/v1/contacts \
  -H "Authorization: Bearer sk_live_your_key_here"

Node.js

const res = await fetch('https://api.sendbound.com/v1/contacts', {
  headers: {
    Authorization: 'Bearer sk_live_your_key_here',
    'Content-Type': 'application/json',
  },
});

Python

import httpx

client = httpx.Client(
    base_url="https://api.sendbound.com/v1",
    headers={"Authorization": "Bearer sk_live_your_key_here"},
)
response = client.get("/contacts")

Key types

Prefix	Type	Use
`sk_live_`	Secret key	Server-side API calls
`sk_test_`	Test key	Development — emails are not delivered

Never expose your secret key in client-side code, public repositories, or error logs.

Revoking a key

Go to Developer → API Keys, find the key, and click Revoke. The key is immediately invalidated and all requests using it will return 401 Unauthorized.

Authentication