API keys

An API key is a secret that lets an app send mail through your Comail account. Treat it like a password for that app.

Create a key

Open the builder console, choose API keys, and then choose Create key.

Give the key a name that tells you what uses it, such as production website, billing worker, or local testing. Using a separate key for each app makes it easier to disable one without interrupting everything else.

Then choose which domains the key can send from:

• Choose one domain when the app only sends from that domain. This is the safer default.
• Choose All domains only when the same app needs to send from several domains on your account.

The key’s domain setting must include the domain in the message’s From address. It does not change who the app may send to.

Save the key when it appears

Comail shows a new key once. Copy it into your app’s secret manager or encrypted environment settings before leaving the page.

Do not put a key in browser code, a public repository, screenshots, support messages, or ordinary chat. Comail stores a one-way fingerprint so it can verify the key later, but it cannot show you the readable key again.

Use the same key with either SMTP or the HTTP Send API.

Replace or disable a key

If a key is lost, exposed, or no longer needed:

1. Create a replacement key and update the app that uses it.
2. Confirm the app can still send.
3. Disable the old key in the builder console.

Disabling is permanent, and the old key stops working within a minute. Your existing send history remains available.

Keys that have not been used for 60 days are marked not recently used. That is a reminder to check whether the app still needs access; Comail does not disable the key automatically.

A practical setup

For a site that sends account emails and a separate billing worker, create two keys:

Key name	Allowed domain	Used by
production website	updates.example.com	Sign-in links and notifications
billing worker	receipts.example.com	Receipts and payment notices

If either key leaks, the other app and domain do not need to change.