Authentication
One key, sent as a bearer token, carrying only the scopes you gave it.
Every requestcurl https://api.transmit.dev/v1/templates \
-H "Authorization: Bearer tr_v2_a1b2c3d4e5f6_…"Keys
Keys look like tr_v2_<prefix>_<secret>. The prefix is stored so the dashboard can show you which key is which; the secret is not — we keep an HMAC of the whole token and compare it in constant time. A key you have lost cannot be read back, only replaced.
Keys can be given an expiry, and can be revoked at any time. A revoked or expired key is indistinguishable from a wrong one: 401, every time.
Scopes
A call that needs a scope the key lacks is refused with 403 and the name of the scope it wanted. Nothing is partly done first. category:* grants a whole family, and * grants everything a key is allowed to reach.
| Field | Type | Notes |
|---|---|---|
email:send | write | Send email, through /v1/emails or a provider-compatible path. |
sms:send | write | Send SMS. |
sms:read | read | List and read SMS messages. |
template:read | read | List and read templates. |
template:write | write | Create, update and delete templates. |
contact:read | read | List contacts. |
contact:write | write | Create and update contacts. |
campaign:read | read | List audiences and campaigns. |
campaign:write | write | Create audiences and campaigns. |
webhook:manage | write | Create, update and disable webhook endpoints. |
analytics:read | read | Read delivery aggregates. |
No API key reaches an administrative route, whatever its scopes. Those live behind separate credentials and are not part of the public API.
Keeping a key safe
- Server side only. A key in a browser is a key anybody can read.
- One key per service, scoped to what that service does, so a leak has a blast radius you can describe.
- Rotate by creating the replacement, deploying it, then revoking the old one — never the other order.