Scoped API tokens
Create a token from the dashboard (API tokens) with only the scopes it needs, e.g. emails:send, events:read, webhooks:write, domains:read. A token with no scopes granted has no access to any scope-gated endpoint; there's no implicit full-access default.
Every token is either LIVE (sends real email) or TEST (routed into the Sandbox, see below, and never touches a real mailbox or your sending quota). Pick TEST when wiring up an integration for the first time.
Set an optional expiration date, and rotate a token at any time. Rotation invalidates the old value and issues a new one, with an optional grace period (up to 24h) so you can redeploy consumers without downtime instead of an instant cutover.
Common scopes
emails:send, events:read, suppressions:read/write, webhooks:read/write, domains:read/write, mailboxes:read/write
Wildcards
* grants everything; a group wildcard like emails:* grants every action within that resource
Sandbox: a real test environment
Create a Sandbox project from the dashboard. It gets its own SMTP and API credentials, completely isolated from your production domains and sending quota. Every email sent with a TEST-mode token or the Sandbox SMTP credentials lands in that project instead of a real inbox.
Inspect every captured message: rendered HTML preview, a spam-likelihood report, the full delivery timeline, and, for webhook-driven integrations, replay any webhook delivery on demand to test your receiving endpoint without resending the email.
Send your first email
One REST call, any language. Example with curl:
curl -X POST https://your-domain/v1/emails/send \ -H "Authorization: Bearer YOUR_API_TOKEN" \ -H "Content-Type: application/json" \ -d '{"from":"you@yourdomain.com","to":"someone@example.com","subject":"Hello","html":"<p>Hi there</p>"}'
The same payload shape works from Node (fetch/axios) or Python (requests): swap the HTTP client, keep the JSON body identical.
Verifying webhook signatures
Every webhook delivery is HMAC-signed and carries a timestamp for anti-replay protection. Verify the signature server-side before trusting the payload: recompute the HMAC over the raw request body using your webhook's signing secret (visible once, at creation, from the dashboard) and compare it to the signature header.
Failed deliveries are retried automatically, and every attempt (status, latency) is logged and viewable from the dashboard so you can debug an integration without guessing.
© 2026 Inkbox SAS