Guides

Authentication

Scoped keys for application traffic. User sessions for administration.

Create a key

Keys are workspace-bound, shown once, and expire after 1–365 days (default 30). An account can have ten active keys. Save tokens in your secret manager.

Example

inboxit keys create --name backend --scopes emails:send,emails:read,inboxes:read,messages:read

Scopes

Grant the smallest set your integration needs.

Scope	Permission
inboxes:read	List inboxes
inboxes:create	Provision an inbox
messages:read	Read messages and raw source
emails:send	Submit API or SMTP email
emails:read	Read outgoing emails, domains, analytics, logs and usage

HTTP authentication

Send Authorization: Bearer <key>. X-Workspace-Id selects a workspace for user sessions; a key cannot cross its workspace boundary.

Example

curl https://inboxit.wtf/api/v2/usage -H "Authorization: Bearer $INBOXIT_API_KEY"

Management permissions

Domain mutations, receiving-address changes, key creation, teams and webhook management require an owner/admin user session. Use inboxit login. An emails:send key cannot administer resources. Cookie-authenticated browser writes also require X-CSRF-Token; the CLI handles this.

Session lifecycle

CLI pairing requires explicit browser approval and expires after ten minutes. CLI logout revokes that credential. Parent-session logout invalidates delegated access. Do not share credentials with an agent beyond the account and permissions it needs.