Authentication

Every API request is authenticated with a Bearer API key.

API keys

Keys are created from Dashboard → API Keys and always start with cmd_. The full key is shown once at creation time — cmdsend never stores or displays it again, only a preview (cmd_ab12...).

Making requests

Pass the key in the Authorization header on every request:

curl https://cmdsend.com/v1/emails/msg_123 \
  -H "Authorization: Bearer cmd_your_api_key"

Permissions

Each key is scoped to one or both of these permissions, set at creation:

Key rotation

Deleting a key immediately revokes it. There's no soft-disable — create a new key, roll it into production, then delete the old one.