API key authentication for every request

Last updated May 29, 2026

API Key Format

All Bavimail API keys use the bm_ prefix followed by a random string:

bm_a1b2c3d4e5f6g7h8i9j0...

The prefix lets you identify Bavimail keys in your codebase and secrets scanners.

Authenticating Requests

Pass your API key as a Bearer token in the Authorization header:

curl -X POST https://api.bavimail.com/v2/emails \
  -H "Authorization: Bearer bm_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"aliasId": "alias_abc123", "toEmail": "[email protected]", "subject": "Hello", "body": "<p>Hi</p>"}'

SDK Initialization

import { Bavimail } from 'bavimail'

// Reads BAVIMAIL_API_KEY from env by default
const client = new Bavimail()

// Or pass explicitly
const client = new Bavimail({ apiKey: 'bm_your_key_here' })

Key Management

Create a Key

Open the dashboard

Go to Settings > API Keys in the dashboard.

Create the key

Click Create API Key.

Name the key

Name it something descriptive (e.g., production-backend , staging-agent ).

Copy immediately

Copy the key immediately -- it is shown only once.

Revoke a Key

Find the key

Go to Settings > API Keys.

Revoke it

Find the key and click Revoke.

Immediate effect

The key stops working immediately. Any request using it returns 401 .

Rotate a Key

Create a new key

Create a new key from the dashboard.

Deploy the new key

Deploy the new key to your application.

Verify traffic

Verify traffic is flowing on the new key.

Revoke the old key

Revoke the old key.

Security Best Practices

• Never commit keys to version control. Use environment variables or a secrets manager.

• Use separate keys per environment. One for production, one for staging, one for development.

• Set the narrowest permissions needed. If a key only needs to send email, don't grant domain management.

• Rotate keys periodically. At minimum, rotate when a team member leaves or a key may have been exposed.

• Monitor key usage. Check the dashboard for unexpected spikes in API calls.

Error Responses

How are API keys managed?

Create API keys per environment and per agent via the dashboard or the API itself. Keys are bearer tokens — authenticate every request with Authorization: Bearer sk_... headers. See /docs/authentication for creation, rotation, and revocation.