API keys

permission is full_access (default) or sending_access. Pass domain_id to scope a sending key to one domain (only valid with sending_access; otherwise 422). token is only ever returned here — the response doesn't echo back name, permission, or domain_id.

curl -X POST https://api.irisend.com/api-keys \
  -H "Authorization: Bearer $IRISEND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Production", "permission": "full_access" }'

{ "id": "3f9c2b1a-6e2d-4a3f-9c0b-1a2b3c4d5e6f", "object": "api_key", "token": "ir_8fK3mQ1z_9pR2vT6yB4wL0nC7xE1sH5dJ" }

Never includes the token. Each item is { id, name, created_at, last_used_at } — permission and domain_id aren't returned here either; check the dashboard if you need to see a key's scope.

curl https://api.irisend.com/api-keys \
  -H "Authorization: Bearer $IRISEND_API_KEY"

{
  "object": "list",
  "has_more": false,
  "data": [
    { "id": "3f9c2b1a-6e2d-4a3f-9c0b-1a2b3c4d5e6f", "name": "Production", "created_at": "2026-09-25T09:00:12.481Z", "last_used_at": "2026-09-25T10:03:41.220Z" }
  ]
}

Returns { object, id, deleted }. Requests already in flight with this key may still complete.

curl -X DELETE https://api.irisend.com/api-keys/3f9c2b1a-6e2d-4a3f-9c0b-1a2b3c4d5e6f \
  -H "Authorization: Bearer $IRISEND_API_KEY"

{ "object": "api_key", "id": "3f9c2b1a-6e2d-4a3f-9c0b-1a2b3c4d5e6f", "deleted": true }