Give each site, software or provider its own key, with only the rights it needs. If one of them must no longer access your account, delete its key: the others keep working.
One per account, with every right. The simplest to use: two headers in each call, no token. But replacing it breaks every tool that uses it.
As many as you need. Each one has a name and the rights you choose, and is exchanged for a token valid for 20 minutes. You can delete one without touching the others.
You authorize them from their own site: no key to copy. You can remove their access at any time.
All three are managed in the app, on one page: Settings → SMTP & API → API. They share your account's monthly request quota.
1. Create the key
In the app, under Settings → SMTP & API → API, click Add a key. Give it a name, tick what it can do, and copy the client_id and client_secret: the secret is shown only once.
2. Get a token
Exchange the two values for a token, valid for 20 minutes (expires_in is in seconds). Without a scope parameter, the token receives all the rights of the key; add scope=contacts:read to limit it.
curl -X POST https://api.mailpro.com/oauth/token \
-d "grant_type=client_credentials" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET"
{ "access_token": "eyJhbGciOiJSUzI1Ni…", "token_type": "Bearer", "expires_in": 1200 }3. Call the API
Put the token in the Authorization header. The same token works on the CRM v3, Email v2 and SMS APIs, as long as the key has the required right.
curl https://api.mailpro.com/v3/List \
-H "Authorization: Bearer eyJhbGciOiJSUzI1Ni…"When the token expires, repeat step 2. Keep the token between calls: there is no need to request a new one each time.
Tick only what the tool needs: a stolen key can do nothing more. Each right is independent: contacts:write does not include contacts:read.
| Right | Allows |
|---|---|
contacts:read | View your contacts, lists, tags and segments |
contacts:write | Create, edit and delete your contacts, lists and tags |
email:send | Send emails on your behalf |
email:read | View delivery stats, opens, clicks and bounces |
email:templates:read | View your email templates |
email:templates:write | Create, edit and delete your email templates |
sms:send | Send SMS messages on your behalf |
sms:read | View your SMS balance and message history |
sms:contacts:read | View your SMS phone book |
sms:contacts:write | Create, edit and delete entries in your SMS phone book |
webhooks:manage | Subscribe to, edit and remove webhook endpoints |
account:read | View your account credits, limits and subscription |
| Action | Effect |
|---|---|
| Edit an extra key | Name and rights change, the secret stays the same. The new rights apply to the next tokens; a token already issued keeps its rights for up to 20 minutes. |
| New secret | The old secret stops working: only this key is affected. Tokens already issued stay valid for up to 20 minutes. |
| Delete an extra key | The key can no longer get tokens; tokens already issued stay valid for up to 20 minutes. The other keys keep working. |
| Replace the main key | The old key stops working immediately: update every tool that uses it. Extra keys and connected tools keep working. |
| Delete the main key | Closes all API access for the account immediately: main key, extra keys and connected tools. |
| Response | Meaning |
|---|---|
401 invalid_client | Wrong client_id or client_secret, or deleted key (when requesting a token). |
401 unauthorized | Missing, invalid or expired token: request a new one. |
403 insufficient_scope | The key does not have the right required by this endpoint. |
403 no_api_access | API access is closed on this account. |
429 quota_exceeded | The account's request quota is used up. |
authorization_code for your own “Connect Mailpro” button.