Definition
API keys are the credentials that allow different software systems to communicate with your email platform. Managing them securely is essential because a compromised API key can be used to send unauthorised email, access subscriber data, or disrupt your email program.
Best Practices
- Create separate keys: Use different keys for development, staging, and production environments
- Scope keys: Restrict each key to the minimum permissions needed (e.g., read-only for analytics, send-only for campaigns)
- Rotate regularly: Regenerate keys every 90-180 days
- Store securely: Use environment variables or a secrets manager, never hard-code keys in source code
- Revoke immediately: When a key is compromised or an integration is decommissioned
- Monitor usage: Track which keys are making which requests to detect unusual activity
Common Mistakes
Hard-coding keys in source code (they end up in version control), using the same key across environments, and failing to revoke keys when team members leave are the most frequent security gaps.
Related Glossary Terms
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Customer Data Platform (CDP) for Email
A customer data platform (CDP) is a system that unifies customer data from multiple sources into a single profile, enabling advanced email personalisation, segmentation, and cross-channel coordination.
Email Deliverability
Email deliverability is the ability to land in the recipient's inbox rather than the spam folder. It depends on sender reputation, authentication, list quality, and content practices.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC (Domain-based Message Authentication)
DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that builds on SPF and DKIM to prevent domain spoofing and provide reporting on authentication failures.
Email Alias
Alternative email addresses or subaddressing patterns that forward to a primary mailbox, affecting subscriber identity tracking and deduplication in email marketing.