API keys

SushiSend API keys carry the format ssk_live_<32-char-random> (production) or ssk_test_<32-char-random> (test). The prefix is visible in the dashboard; the secret portion is shown once, at creation time, then hashed and never shown again.

Create a key

Dashboard → API keys → New key. Give it a human-readable name (production backend, billing-service prod, etc.) and an environment (live or test). Copy the secret and store it in your secret manager — we can’t show it to you again.

Use a key

Send it as a Bearer token on every request:

curl -X POST https://api.sushisend.com/v1/emails \
  -H "Authorization: Bearer ssk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"from":"hello@yourdomain.com","to":"user@example.com","subject":"Hi","text":"Hello"}'

Rotate

Dashboard → API keys → (row) → Revoke. The key stops working instantly. Create a new key, swap it in your app, confirm traffic, then revoke the old one. Revoked keys stay visible in the list (for audit) but can’t authenticate.

Scope (roadmap)

Today keys are workspace-scoped with full permissions inside that workspace. Per-key scope (emails:send, contacts:read, etc.) lands in a future release.