Authentication

API keys and their three levels.

Send your key in the Authorization header: Authorization: Bearer sl_…. Requests also need a User-Agent header (every HTTP client sends one).

Level	Can do	Where to use it
`full_access`	Everything	Your servers, CI, agents
`sending_access`	`POST /emails` only (optionally one domain)	Apps that only send transactional email
`signups`	`POST /signups` only	Your site's signup form, in public code

A workspace can have 20 active keys. A token is shown once, at creation; we only store its hash. Revoking a key stops it at once.

Signup form example

A signups key can only add pending contacts, who must confirm by email. It is safe to ship in your page:

<form id="signup"><input name="email" type="email" required><button>Subscribe</button></form>
<script>
document.getElementById("signup").addEventListener("submit", async (e) => {
  e.preventDefault();
  await fetch("https://api.smartletter.ai/signups", {
    method: "POST",
    headers: { "Authorization": "Bearer sl_your_signups_key", "Content-Type": "application/json" },
    body: JSON.stringify({ email: e.target.email.value, source_url: location.href }),
  });
  e.target.textContent = "Check your inbox to confirm.";
});
</script>