Runs examples for real against your account. Test keys only; kept in this tab, never stored on our side. Get a key
ZapSMTP / Docs / API keys & SMTP credentials

Create an API key

POST/v1/api-keys

Create an API key; the full key (token) is returned only once.

Requires a full-access live key; test keys get 403 test_key_restricted.

Body parameters

namestringrequired
Limits: 1-100 characters (not trimmed) → 422 invalid_parameter "name is required (max 100 chars)"
permissionstring
One of full_access, sending_access. Default full_access.
domain_idstring
Restrict sending to one of the account's domains. Only with sending_access. Limits: 422 "domain_id can only be used with sending_access" / "unknown domain_id"
modestring
test creates a zap_test_ key (see API keys). One of live, test. Default live.
streamstring
Restrict the key to one message stream. One of transactional, broadcast.
expires_atstring (RFC 3339)
Limits: must be in the future → 422 "expires_at must be in the future"
expires_in_daysinteger
Alternative to expires_at; when > 0 it overrides expires_at.

Errors

key_restrictedHTTP 403
this API key expires, so the keys it manages must expire no later than it does | this API key is limited to the <stream> stream, and so are the keys it manages
restricted_api_keyHTTP 403
test_key_restrictedHTTP 403
test-mode keys can send test email and read, not change the account: use a live key
invalid_parameterHTTP 422
name, permission, domain_id, mode, stream or expiry invalid
POST/v1/api-keys
curl -X POST 'https://zapsmtp.xyz/v1/api-keys' \
  -H "Authorization: Bearer $ZAP_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "checkout-service",
  "permission": "sending_access",
  "mode": "live"
}'
Set ZAP_API_KEY in your environment.
Response 201 Created
{
  "id": "019a1f05-3c4d-7e5f-8a6b-7c8d9e0f1a2b",
  "token": "zap_8fK2mQ9xLr3TzV7bN1cW5yHjP0aS4dE6gU2iO9kX",
  "key": {
    "id": "019a1f05-3c4d-7e5f-8a6b-7c8d9e0f1a2b",
    "name": "Production",
    "prefix": "zap_8fK2mQ",
    "permission": "sending_access",
    "mode": "live",
    "stream": null,
    "expires_at": null,
    "domain_id": "019a1f10-8a10-7b22-8c31-5d2e9f0a4b17",
    "last_used_at": null,
    "created_at": "2026-10-21T15:30:00Z"
  }
}