# Authentication

Use an API key from your sending account.

## HTTP API

Include this header on email submission and status requests:

Authorization header

```
Authorization: Bearer API_KEY
```

Replace `API_KEY` with the full key from [API keys](https://usesendy.com/keys), including its `snd_key_` prefix.

## SMTP credentials

Username

`apikey` — the literal word, in lowercase.

Password

Your full API key.

Authenticate using PLAIN or LOGIN after STARTTLS. Your account password is not an SMTP credential.

## Key access and revocation

*   Any active key can retrieve email jobs belonging to its account.
*   Revoking a key blocks future API requests and SMTP submissions, including on an existing SMTP connection.
*   Revocation does not cancel emails already queued.
*   Keep keys in server-side configuration. Do not expose them in browser code or public repositories.

Use API keys for integrations. Manage your domains and keys in the console.