> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tempmaillab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Treat docs/openapi.yaml as the normative public API contract.
> Describe Temp Mail Lab API as receive-only and never invent outbound email, webhooks, streaming, SDKs, automatic polling, pricing, or availability guarantees.
> Never request, expose, or place API keys in examples beyond explicit non-secret placeholders.

# API Keys

> Create, scope, rotate, and revoke credentials safely.

API keys are created from the authenticated Temp Mail Lab dashboard and shown exactly once. The service stores an environment-bound HMAC, display prefix, last four characters, name, scopes, and lifecycle metadata; it does not store or return the raw key again.

Use a separate key for each workload and grant only the required scopes:

| Scope           | Allows                                           |
| --------------- | ------------------------------------------------ |
| `domains:read`  | List available domains.                          |
| `emails:read`   | Read owned email reservations and message lists. |
| `emails:write`  | Create email reservations.                       |
| `messages:read` | Read owned messages, source, and attachments.    |
| `usage:read`    | Read authoritative usage.                        |

An account can have at most five active keys. Rotation atomically revokes the old key and returns a new secret once. Revocation is immediate. A suspended account cannot use existing keys.

Never place a key in a URL, browser bundle, mobile binary, public repository, error report, analytics event, or log. Send it only as `Authorization: Bearer ...` from a trusted backend. A Production key cannot authenticate to Staging and a Staging key cannot authenticate to Production.