Guides
Authentication
Authenticate server-side requests with workspace API keys and the smallest required scopes.
On this page
Bearer authentication
Send the API key in the Authorization header on every RouteKite request.
Header
Authorization: `Bearer ${process.env.ROUTEKITE_API_KEY}`Key scopes
| Scope | Allows |
|---|---|
| email:send | Send email and prepare, complete, or inspect attachments. |
| email:read | List and retrieve transactional messages, events, and message attachments. |
| template:read | List templates and retrieve drafts or immutable versions. |
| template:write | Create, update, save, publish, duplicate, or delete templates. |
| audience:read | List contacts, fields, topics, segments, and audience exports. |
| audience:write | Manage contacts, fields, topics, segments, preferences, and audience exports. |
| campaign:read | List campaigns and inspect campaign reports or schedules. |
| campaign:write | Create campaigns and select their audience and topic. |
| campaign:send | Send or schedule campaigns and access campaign reports. |
| webhook:manage | List, create, inspect deliveries for, and delete webhook endpoints. |
| email:send fallback | A sending key may also read email resources in its workspace. |
Store keys safely
- Keep keys in server environment variables.
- Never embed keys in browser bundles or public repositories.
- Use separate keys for applications that need independent access.
- Remove keys that are no longer used.
Authentication failures
| Status | Meaning | Action |
|---|---|---|
| 401 | The Bearer key is missing or invalid. | Check the complete Authorization header. |
| 403 | The key lacks the required scope. | Use a key with the required access. |
| 403 | The workspace cannot perform the operation. | Resolve the workspace notice in RouteKite. |