> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and Manage turboSMTP API Keys

> Create Consumer Key and Secret pairs, select SMTP and API permissions, restrict access by IP, and rotate credentials within your plan's key limit.

Create a Consumer Key / Secret pair for each turboSMTP integration. Use the pair for SMTP, HTTP sending, or supported management API operations, with permissions chosen for that application's needs.

## Create credentials

**1. Open API keys**

Sign in to the [dashboard](https://dashboard.serversmtp.com) and open **Settings → Integrations → API Keys → Edit**.

**2. Configure a key**

Start creating a key and enter a descriptive label. Select the services it may use. Optionally restrict access to your application's public outgoing IP addresses.

**3. Store the key and secret**

Generate the key pair and copy the **Consumer Key** and **Consumer Secret** to your password manager or application secret store. The secret is shown only when the pair is created.

> [!WARNING]
>
> If you lose a Consumer Secret, create a replacement key pair. Update and verify every application that uses the old pair before deleting the old key. Do not put secrets in source control, browser code, or support messages.

## Permissions

| Dashboard service | API permission | Use |
| - | - | - |
| SMTP Sending | `SEND_SMTP` | SMTP authentication on `pro.turbo-smtp.com` or `pro.eu.turbo-smtp.com` |
| HTTP API Sending | `SEND_API` | `POST /mail/send` on the global or EU send host |
| Statistics & Management APIs | `APIS` | Supported management, analytics, suppressions, validation, alerts, and sub-account endpoints |

One pair can have several permissions. Grant only those required by the application. Consumer-key management and password changes still require a session API key; see [authentication exceptions](/docs/api-reference/authentication.md#endpoints-that-require-a-session-api-key).

## Key limits

| Plan | API keys |
| - | - |
| Free | 2 |
| Basic | 5 |
| Pro | Unlimited |
| Enterprise | Unlimited |

See the current [pricing comparison](https://serversmtp.com/pricing/) for plan limits. If you reach your limit while rotating credentials, plan the replacement before deleting an active key.

## IP restrictions

An IP-restricted key can only be used from its allowed addresses. Configure the public outgoing addresses of your servers, rather than private LAN addresses. Account for address changes or additional outgoing gateways when deploying your application.

## SMTP

```text SMTP credentials theme={"system"}
Global host: pro.turbo-smtp.com
EU host:     pro.eu.turbo-smtp.com
Port:        587 with STARTTLS, or 465 with implicit TLS
Username:    YOUR_CONSUMER_KEY
Password:    YOUR_CONSUMER_SECRET
```

Enable **SMTP Sending**. The username is the Consumer Key and the password is the Consumer Secret. Your dashboard login password is not the SMTP password. Both hosts also support STARTTLS on `25` and `2525`, and implicit TLS on `25025`; see [SMTP setup](/docs/get-started/smtp-configuration.md).

## HTTP sending

```bash Send an email theme={"system"}
curl 'https://api.turbo-smtp.com/api/v2/mail/send' \
  -H 'consumerKey: YOUR_CONSUMER_KEY' \
  -H 'consumerSecret: YOUR_CONSUMER_SECRET' \
  -H 'Content-Type: application/json' \
  -d '{"from":"sender@example.com","to":"recipient@example.com","subject":"Hello","content":"Hello from turboSMTP."}'
```

Enable **HTTP API Sending**. Use `https://api.eu.turbo-smtp.com/api/v2/mail/send` for the EU sending route. `Authorization` is ignored by this endpoint and cannot replace the Consumer headers.

## Management APIs

Enable **Statistics & Management APIs** and pass both Consumer headers on supported management calls:

```bash List suppressions theme={"system"}
curl --get 'https://pro.api.serversmtp.com/api/v2/suppressions' \
  -H 'consumerKey: YOUR_CONSUMER_KEY' \
  -H 'consumerSecret: YOUR_CONSUMER_SECRET' \
  --data-urlencode 'from=2026-10-01' \
  --data-urlencode 'to=2026-10-27'
```

Use Consumer credentials for your integrations. Email/password `/authorize` login is only needed for a few session-only operations. See [authentication](/docs/api-reference/authentication.md) for those exceptions and the login rate limit.

## Legacy credentials

Some older accounts have an automatically generated Consumer Key whose value equals the account email. The API identifies it with `is_legacy: true`; it may not be shown in the dashboard key list. It still represents a Consumer Key with its associated secret. Do not replace a newly created key with your email address. New sub-accounts need a key pair of their own.

## Edit or revoke credentials

Open **Settings → Integrations → API Keys → Edit** to manage your keys. Delete a key when you no longer need it or suspect compromise. Update applications before revoking a pair that is still in use. For programmatic creation, listing, updates, and deletion, see the [Consumer Keys API](/docs/api-reference/consumer-keys.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.