API keys
Applications authenticate with project-scoped API keys - never with user accounts. A key grants exactly one capability: sending email through its project.
Key format
solen_c9b66f1d_69466649cbe75fa05bd2113342eee481
└──┬┘ └──┬───┘ └───────────────┬───────────────┘
prefix key id secret (shown once)The platform stores only a SHA-256 hash of the full key. The plaintext is shown a single time - at creation or rotation. If you lose it, rotate; there is nothing to recover.
Operations
| Action | Effect |
|---|---|
| Generate | Creates a named key; copy the plaintext from the one-time dialog. |
| Rotate | Replaces the secret in place. The old value stops working immediately; the key's name and history remain. |
| Revoke | Permanently disables the key. Requests with it return UNAUTHORIZED. |
The dashboard shows each key's last used timestamp - a quick way to find dead keys before revoking them.
Project roles
Keys are managed by humans with roles on the project:
| Role | Can |
|---|---|
OWNER | Everything - settings, members, keys, templates, deletion. |
DEVELOPER | Templates (create, edit, test-send) and read access to logs and keys. |
VIEWER | Read-only: logs, analytics, template list. |
Handling keys well
- One key per deploying environment (
schoolos-production,schoolos-staging) - rotation then never breaks the other environment. - Keys belong in secret managers or env vars, never in code or client-side bundles.
- Rotate on team departures and suspected leaks; it's one click and takes effect instantly.