Authentication
Every request carries an API key as a bearer token. Keys belong to one account, are either test or live, and have scopes that limit what they can do.
curl https://api.mailpark.io/v1/me \
-H "Authorization: Bearer sk_test_…"A missing or wrong key returns 401 unauthorized. Check a key with GET /v1/me: it returns the key's name, environment and scopes.
Test and live keys
| Prefix | Sends real email | Use it for |
|---|---|---|
sk_test_… | Never. Everything lands in the test inbox. | Development, CI, and AI agents. |
sk_live_… | Yes, once a person has gone live. | Your production app. |
Create keys in Settings → API keys. The full key is shown once. Revoking a key stops it straight away. Read more in test and live mode.
Scopes
A key can only call endpoints its scopes allow; anything else returns 403 missing_scope. Reading most objects needs no scope. New keys get every scope except sequences:activate on live keys.
| Scope | Allows |
|---|---|
emails:send | Send single and batch emails. |
contacts:write | Create, update and delete contacts and lists. |
events:write | Record events and define event types. |
templates:write | Create and change templates and upload images. |
broadcasts:draft | Draft broadcasts. Approving them is always a person's job. |
sequences:write | Create, change and turn off sequences. |
sequences:activate | Turn sequences on. Test keys only. |
webhooks:write | Add and remove webhooks. |
logs:read | Read the send log, contacts, events and activity. |
domains:write | Add, remove and set up sending domains. |
What only people can do
Some actions always need someone signed in to the web app. API keys, and so AI agents, get 403 humans_only:
- Approve, reject or release broadcasts
- Go live
- Resume marketing after a pause
- Change the plan, billing, payment method or spending cap
- Create or revoke API keys, and manage the team
- Bulk-delete contacts
Agents can still prepare all of it. A drafted broadcast comes back with an approval_url: give that link to the person who approves it.
Audit log
Every change made with a key is recorded with the key's name. Read it with GET /v1/activity, or filter to one key with ?actor_type=api_key&actor_id=key_….