Create API Key

Create a new API key for the organization. The full token is only returned once at creation time.

POST/api-keys

Resend Compatibility: Compatible

Requires an API key with api_keys:write permission.

Body Parameters

namestringrequired

A descriptive name for the API key.

permissionstring

Permission level: full_access or sending_access. Default full_access.

full_access — can access all API endpoints
sending_access — can only send emails (POST /emails and POST /emails/batch)

domain_idstring

Restrict a sending_access key to sending from one of your domains. A send whose from is on any other domain is refused with 401 restricted_api_key. For full_access, this does not limit sending, but the domain ID is still stored and shown in the dashboard. If the ID does not belong to this organization, the request fails with 400 and Domain not found in this organization.

The new key can have only permissions and sending-domain scope already held by the key making this request: a key limited to one domain cannot create a sending_access key for another domain or for every domain. Otherwise the request fails with 401 restricted_api_key.

Response Fields

idstring

The API key ID.

objectstring

Always api_key.

tokenstring

The full API key token (e.g. sk_xxxxxxxxx). Store this securely — it cannot be retrieved again.

curl -X POST 'https://api.postflare.dev/api-keys' \
  -H 'Authorization: Bearer sk_xxxxxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Production Key",
    "permission": "full_access"
  }'

// Set RESEND_BASE_URL=https://api.postflare.dev in the environment before
// the process starts. Without it the SDK sends to api.resend.com, silently.
import { Resend } from 'resend';

const resend = new Resend('sk_xxxxxxxxx');

const { data, error } = await resend.apiKeys.create({
  name: 'Production Key',
  permission: 'full_access',
});

Response

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "object": "api_key",
  "token": "sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}