Skip to main content

​
API keys

All public developer API requests require an API key passed in the X-API-Key header.
Keys follow the format tor_ + base64url-encoded random bytes.

​
Key types

​
Workspace key

Created from the authenticated Torpedo dashboard. Can send from any verified domain in the workspace.

​
Domain-scoped key

Created from the authenticated Torpedo dashboard with a domain selected. Can only send from that specific domain. Use these for multi-tenant setups or to isolate sending by domain.

​
Getting your key

Keys are returned once only at creation time and cannot be retrieved again. If you lose a key:
  1. Revoke it from the dashboard or with DELETE /api/v1/auth/keys/{id}
  2. Create a new one from the dashboard

​
Security best practices

Never expose API keys in client-side code, public repositories, or browser environments. Keys grant full send access on behalf of your domain.
  • Store keys in environment variables (TORPEDO_API_KEY)
  • Use domain-scoped keys when possible — limits blast radius if a key leaks
  • Rotate keys periodically using the revoke + create flow
  • Set up webhooks to monitor for unexpected sending activity