API keys

Every request needs an API key in the Authorization header:

Authorization: Bearer vx_live_pt7m2k9xr4m1c8d3hq2kv9xr4m1c8d3

Scopes

Scope	Can do
send	Send emails (POST /emails, POST /emails/batch). Nothing else.
full	Everything: send, read emails, manage domains and API keys.

Give your applications send-only keys. If one leaks, it can’t read your email history or create more keys. A key can also be limited to one domain with domainId.

Keeping keys safe

• Vaartix stores only a hash of each key. It’s shown once, when created; if you lose it, create a new one.
• Keep keys in environment variables or a secret manager, never in code or Git.
• Never use a key in browser or mobile app code: anyone could read it. Send from your server.
• Revoke a key the moment you suspect it leaked: DELETE /api-keys/{id}. It stops working immediately.

The first characters of each key (prefix, for example vx_live_pt7m) are shown in lists so you can tell keys apart.