API_USER
This comprehensive guide covers everything you need to know about API_USER credentials, which serve as your primary authentication method for accessing our Email Delivery API and SMTP services.
What is an API_USER?
An API_USER is a specialized credential system designed exclusively for programmatic email sending. Unlike your platform login account, API_USERs are purpose-built for:
- Automated email sending via API calls or SMTP
- Secure authentication without exposing your main account credentials
- Granular access control with specific permissions and limitations
- Isolated credential management for different applications or environments
Think of API_USERs as service accounts - each one is tailored for a specific email sending purpose and can be managed independently.
Creating Your First API_USER
When setting up an API_USER, you'll configure three essential properties that determine its capabilities and behavior.
1. Email Type
Choose the appropriate type based on your sending needs:
Best for: Transactional emails
• Password resets
• Order confirmations
• Account notifications
• System alerts
Restrictions: Cannot send marketing emails
Best for: Marketing campaigns
• Newsletters
• Promotional emails
• Announcements
• Marketing automation
Restrictions: Cannot send transactional emails
Important: Email type cannot be changed after creation. Plan carefully based on your intended use case.
2. Sending Domain Configuration
Every API_USER must be bound to an authenticated sending domain:
- Domain Authentication Required: The domain must be verified and have proper DNS records configured
- Sender Reputation: All emails will originate from this domain, affecting your sender reputation
- Deliverability Impact: Proper domain setup is crucial for inbox placement
Domain Setup Checklist
Before binding a domain to your API_USER:
- ✅ Domain is verified in your account
- ✅ SPF record is properly configured
- ✅ DKIM signing is enabled
- ✅ DMARC policy is set (recommended)
- ✅ Domain has positive sending reputation
3. Tracking and Analytics
Enable tracking to monitor email performance:
When Tracking is Enabled:
- Open rate tracking
- Click-through tracking
- Unsubscribe monitoring
- Spam complaint tracking
Privacy Considerations:
- Tracking uses invisible pixels and link redirects
- Consider privacy regulations in your jurisdiction
- Provide clear opt-out mechanisms for recipients
API_KEY Management
The API_KEY functions as the "password" for your API_USER and requires careful handling.
Generating Your First API_KEY
- Navigate to your API_USER management dashboard
- Select the API_USER you want to generate a key for
- Click "Generate API_KEY"
- Copy and store the key immediately - it's shown only once!
Security Critical: The API_KEY is displayed only once upon generation. If you lose it, you must reset to get a new one.
Resetting API_KEYs
Individual Reset:
- Generates a unique new key for one API_USER
- Ideal for compromised credentials or routine rotation
Batch Reset:
- Assigns the same new key to multiple selected API_USERs
- Useful for simplifying key management across similar services
Grace Period Protection
When you reset an API_KEY:
- New key: Active immediately
- Old key: Remains valid for 15 minutes
- Your applications: Continue working during the transition
This grace period prevents service disruption while you update your applications.
Key Management Best Practices
Storage:
- Use environment variables in production
- Leverage secure credential management systems
- Never commit keys to version control
Rotation Schedule:
- Rotate keys every 90-180 days minimum
- Rotate immediately if compromise is suspected
- Document rotation procedures for your team
Access Control:
- Limit who can generate/reset keys
- Use separate API_USERs for different environments
- Monitor key usage patterns for anomalies
Authorized Recipients
Authorized Recipients is an email sending restriction feature exclusively for the Test API_User.This restriction applies only to the Test API_User. Non Test API_User is not subject to this constraint.
Adding Authorized Recipients
- Log in to the platform and navigate to the API_USER page under Email API.
- Click the "Manage Authorized Recipients" button to enter the authorized recipient management page.
- Enter the email addresses to be authorized in the input field.
- You can add multiple email addresses at once. Use the English semicolon
;to separate multiple addresses.Example:
[email protected];[email protected];[email protected] - A maximum of 10 email addresses can be added.
- Save after confirming the information is correct.
Lock Mechanism After Adding
- Once the authorized recipient list is saved, it will immediately enter a 7-day lock period.
- During the lock period:
- The Test API_User can only send emails to addresses in the list or the registered email address.
- The authorized recipient list cannot be modified (including adding, deleting, or editing).
- After the lock period ends:
- Once the 7-day lock period is over, you can click "Manage Authorized Recipients" again to edit the list.
Troubleshooting Common Issues
Authentication Failures
Symptoms: 401 Unauthorized errors, authentication failures
Common Causes:
- Incorrect API_USER name or API_KEY
- Using expired credentials after reset
- API_USER not properly configured
Solutions:
- Verify API_USER name matches exactly (case-sensitive)
- Ensure API_KEY is current and not expired
- Check if API_USER is active and not suspended
- Regenerate API_KEY if in doubt
Domain-Related Errors
Symptoms: Domain verification errors, sending failures
Common Causes:
- Sending domain not bound to API_USER
- Domain not properly authenticated
- DNS configuration issues
Solutions:
- Verify domain is bound to the API_USER
- Check domain authentication status
- Validate DNS records (SPF, DKIM, DMARC)
- Contact support for domain-specific issues
Email Type Restrictions
Symptoms: Emails rejected due to type mismatch
Common Causes:
- Trigger API_USER trying to send marketing emails
- Batch API_USER trying to send transactional emails
- Incorrect email classification
Solutions:
- Review your API_USER type configuration
- Create separate API_USERs for different email types
- Ensure email content matches API_USER type
- Update your application logic accordingly
Security and Compliance
Security Framework
• Secure storage practices
• Regular key rotation
• Access logging and monitoring
• Immediate compromise response
• HTTPS/TLS encryption required
• IP allowlisting available
• Rate limiting protection
• DDoS mitigation
• GDPR compliance features
• CAN-SPAM compliance tools
• Audit trail maintenance
• Data retention controls
Compliance Considerations
- Data Protection: Ensure recipient data is handled according to applicable privacy laws
- Consent Management: Maintain proper opt-in/opt-out mechanisms
- Audit Trails: Keep records of email sending activities
- Geographic Restrictions: Understand regional sending limitations
Next Steps
Need Help? If you encounter issues not covered in this guide, our support team is ready to assist with API_USER configuration and troubleshooting.
Updated 29 days ago