# Create and manage API keys

API keys authenticate applications, scripts, and MCP clients without exposing your Prontuno account password.

## Choose the correct key type

- Key type | Use it for | Scope | Can send email?
- Sending | Application servers that send transactional email | Bound to one verified domain; can read messages for that domain and view suppressions | Yes
- MCP | Approved AI agents and MCP clients | Account-wide domain, message, and suppression management | No
- Management | Administrative scripts and internal tools | Account-wide domain, message, and suppression management | No

Use the narrowest key type that can complete the task. An MCP or Management key cannot send email.

## Create an API key

1. Open **API Keys** in the Prontuno dashboard.
2. Select **New API Key**.
3. Choose the key type.
4. Enter a descriptive name that identifies the application and environment.
5. For a Sending key, choose a verified domain.
6. Confirm the operation with your account password.
7. Copy the API key and store it securely.

### API keys are displayed once

If a key is lost, revoke it and create a replacement. Prontuno cannot display the full secret again.

## Authenticate an API request

Send the key as a bearer token over HTTPS:

```
Authorization: Bearer YOUR_PRONTUNO_API_KEY
Accept: application/json
Content-Type: application/json
```

Use the API hostname and endpoint from the relevant Prontuno API reference. Never place a secret key in a query string.

## Protect API keys

- Store keys in a secret manager or encrypted environment configuration.
- Never expose a key in browser JavaScript, a mobile app bundle, or a public repository.
- Create separate keys for production, staging, local development, and each integration.
- Do not share a key between unrelated applications.
- Restrict dashboard access to people who need to manage credentials.
- Revoke unused keys and rotate any key that may have been exposed.

## Rotate a key without downtime

1. Create a replacement key with the same type and domain.
2. Add it to the application’s secret store.
3. Deploy or restart the application so it uses the replacement.
4. Confirm successful requests and email activity.
5. Revoke the old key in Prontuno.

## MCP authorization

When an MCP client starts Prontuno’s OAuth flow, sign in on the Prontuno authorization page and choose an existing MCP key or create a new one. Review the client before granting access. Revoke the MCP key when the client is no longer trusted or used.

## Next steps

If your application already supports SMTP, you can use an [SMTP credential](https://prontuno.com/docs/sending/send-email-with-smtp/) instead of a Sending API key.