Skip to main content
Use a Consumer Key and Consumer Secret for production integrations. HTTP requests send them as consumerKey and consumerSecret headers. SMTP uses the Consumer Key as the username and the Consumer Secret as the password. You can manage keys in Settings → Integrations → API Keys → Edit.

​
Authentication

Base URL: https://pro.api.serversmtp.com/api/v2 Consumer-key management is a session-only exception. Create, list, update, and delete requests require a session API key as the raw Authorization value, without Bearer:
Consumer credentials return not_allowed_for_consumerkey on these routes. Use the dashboard to manage keys if you do not have a working session token. To get a session token, sign in with POST /authorize using your dashboard email and password; see authentication.

​
Permissions

If you omit permissions when creating a key, all three permissions are granted. Send an explicit nonempty list to limit access. ips is an array of allowed IP addresses. Omitting it on creation or sending [] leaves the key unrestricted. Replace example IPs with your application’s public outbound IP.

​
Create a key

POST /user/consumerKeys accepts label, permissions, and ips.
Terminal
The 201 response contains only the new pair:
Store the secret securely when you create the key. List responses do not include it. Keep both credentials out of client-side code, logs, and version control.

​
List keys

Terminal
GET /user/consumerKeys returns an object with count and results:
A legacy auto-generated key can have the account email as its consumerKey and is_legacy: true. The API can list this key even when the dashboard hides it. It remains a Consumer Key for SMTP authentication; new sub-accounts do not receive one automatically.

​
Update a key

Use PUT /user/consumerKeys/{consumerKey} to update the label, IP restrictions, and permissions. The path contains the Consumer Key string returned by create or list. Send permissions and ips on every update. An omitted permissions field resets the key to all three permissions, and an omitted ips field clears its IP restrictions. Only an omitted label stays unchanged. A failed update returns 400 with Could not update API key.
Terminal

​
Revoke a key

DELETE /user/consumerKeys/{consumerKey} revokes the pair. Update applications that use it before revocation.
Terminal
A successful deletion returns {"message":"success"}. An unknown key returns 404 with message: "key_not_found".