Skip to main content
API keys are created from the authenticated Temp Mail Lab dashboard and shown exactly once. The service stores an environment-bound HMAC, display prefix, last four characters, name, scopes, and lifecycle metadata; it does not store or return the raw key again. Use a separate key for each workload and grant only the required scopes: An account can have at most five active keys. Rotation atomically revokes the old key and returns a new secret once. Revocation is immediate. A suspended account cannot use existing keys. Never place a key in a URL, browser bundle, mobile binary, public repository, error report, analytics event, or log. Send it only as Authorization: Bearer ... from a trusted backend. A Production key cannot authenticate to Staging and a Staging key cannot authenticate to Production.
Last modified on August 2, 2026