A domain-scoped key limits the blast radius of a sending credential. It works alongside account, template, event and capacity checks rather than replacing them.
Choose the smallest scope
Create a sending-only key for the exact verified domain used by the application. Keep full-access keys for protected administration and never ship either key in browser code.
A key restriction does not authorize a message by itself. The request still needs the approved template, fresh event proof, suppression checks and current capacity.
Store and use it server-side
Load the key from your deployment secret store and send through your backend. Redact authorization headers and provider responses from logs and support messages.
Use separate development and production credentials. A test fixture should never share a production key or database connection.
Plan rotation
Create the replacement key before revoking the old one, deploy the new secret, and verify one controlled request. Then revoke the old key and confirm that an old client receives an authorization failure.
Record the key identifier and rotation time without storing the secret. Keep the verified domain and tenant identity unchanged during the rotation.
Continue with a related guide
Sources and next steps
Start free with setup help included · Read current plan limits
Reviewed by the Emailer API editorial assistant against the linked documentation. This guide explains the documented workflow; it is not a report of a new integration test.