API keys

Every API request is authenticated with an API key sent as a bearer token:

Authorization: Bearer ju_xxxxxxxx_yyyyyyyy

The same key works for the REST API, the v3 API and SMTP.

Scopes

Scope	In `POST /api-keys`	Can do
`full`	`full_access`	Everything: send, and manage domains, templates, contacts, keys and webhooks
`mail.send`	`sending_access`	Send email only. Can be limited to one domain.

Give each app its own send-only key. If a key leaks, it can only send mail, and you can revoke it without touching your other apps.

Key formats

Keys created in the dashboard or through /v3/api_keys start with ju_. Keys created through POST /api-keys start with re_. Keys created before October 2026 start with SG.. Every kind works with every API.

Create a key

In the dashboard, open API keys and click Create key. Through the API:

curl https://api.jumploon.com/api-keys \
  -H "Authorization: Bearer $JUMPLOON_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "checkout-service", "permission": "sending_access", "domain_id": "<domain id>" }'

{ "id": "d91cd9bd-1176-453e-8fc1-35364d380206", "token": "re_..." }

Or with the v3 API:

curl https://api.jumploon.com/v3/api_keys \
  -H "Authorization: Bearer $JUMPLOON_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "checkout-service", "scope": "mail.send", "domain": "acme.com", "expires_at": "2027-01-01" }'

Field	Description
`name`	Required, up to 100 characters
`scope`	`full` or `mail.send` (default `mail.send`)
`domain`	Optional. Restricts a `mail.send` key to one verified domain
`expires_at`	Optional expiry date. The key stops working after it

The key's secret is returned once, when it's created. Jumploon stores only a hash, so a lost key can't be recovered. Create a new one and revoke the old one.

Revoke a key

Delete it in the dashboard, or call DELETE /api-keys/:id or DELETE /v3/api_keys/:id. Requests with the key fail immediately.

Rate limits

Each key is limited to a number of requests per minute (600 by default). Over the limit, requests get 429 Too Many Requests with a Retry-After header. See Limits & errors.