Guides
Authentication
Authenticate server-side requests with workspace API keys and the smallest required scopes.
On this page
Bearer authentication
Send the API key in the Authorization header on every RouteKite request.
Authorization: Bearer rk_your_keyKey scopes
| Scope | Allows |
|---|---|
| email:send | Send email and prepare, complete, or inspect attachments. |
| email:read | Retrieve transactional message state. |
| email:send fallback | A sending key may also retrieve messages in its workspace. |
Store keys safely
- Keep keys in server environment variables.
- Never embed keys in browser bundles or public repositories.
- Use separate keys for applications that need independent access.
- Remove keys that are no longer used.
Authentication failures
| Status | Meaning | Action |
|---|---|---|
| 401 | The Bearer key is missing or invalid. | Check the complete Authorization header. |
| 403 | The key lacks the required scope. | Use a key with the required access. |
| 403 | The workspace cannot perform the operation. | Resolve the workspace notice in RouteKite. |