Skip to main content

API Keys 🔑

An API key is how your code proves it’s allowed to use your Mailofly account. Think of it as a password — but one that your app uses instead of you typing it in every time.
Your key is shown one time only when you create it. Copy it right away — we don’t save the full key, only a hash of it.

Creating a key

  1. Go to API Keys in your dashboard
  2. Click Create Key and give it a name (like production or staging)
  3. Copy the key — it’ll start with mfly_live_
Then store it as an environment variable so it’s not sitting in your code:

Using it in your app

Every API request needs this header:
In Node.js / TypeScript:
With cURL:

Tips for keeping your key safe

  • 🔑 One key per service — if a key leaks, you only have to rotate that one
  • 🚫 Never commit it to git — seriously, even “just for testing”
  • ⏰ Use short-lived keys for contractors, staging, or one-off scripts
  • 🔄 Rotate regularly — especially if you think it might have been exposed

What’s next?