API Key Security

Protecting your API keys prevents unauthorized access and protects your sending reputation from spam abuse.

Security Best Practices

Never Commit to Source Control: Store API keys in environment variables (MAILOFLY_API_KEY) and add .env to .gitignore.
Never Use in Client-Side Code: Never expose your secret API key in React, Next.js client components (NEXT_PUBLIC_), iOS, Android, or browser JavaScript. All email requests should go through a backend API route.
Use Scoped Keys: Give production servers keys with the minimum required permissions (e.g. Sending Only).
Regular Rotation: Rotate API keys periodically by creating a new key, deploying your server, and revoking the old key.