API reference

API keys API

Reference for creating, listing and revoking API keys, including sending-only keys and keys locked to one domain.

The API keys endpoints manage the keys of the project that owns the calling key. Every endpoint needs a full_access key. For permissions and safe handling, see Authentication.

Create an API key

POST/api-keys

Creates a key and returns its secret once. Returns 201.

Field	Type	Required	Description
`name`	string	Yes	1 to 50 characters.
`permission`	string	No	`full_access` (default) or `sending_access`.
`domain_id`	string	No	Lock the key to one domain in the project. The key can then only send from that domain.

Shell

curl -X POST https://api.sooner.dev/api-keys \
  -H "Authorization: Bearer $SOONER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "marketing-site",
    "permission": "sending_access",
    "domain_id": "jh7b2k4d9x1m5q8r3t6v0w2y"
  }'

JSON

{ "id": "jk3p8m2x7c4v9n1b6q5w0e2r", "token": "sn_..." }

token is the key itself. Sooner stores only a hash, so this response is the only time you can read it. Store it right away.

Notable errors: not_found or validation_error when domain_id does not belong to this project, and restricted_api_key when the calling key is sending_access.

List API keys

GET/api-keys

Returns the project's active keys. Revoked keys are not listed. The list is not paginated and never includes secrets.

Shell

curl https://api.sooner.dev/api-keys \
  -H "Authorization: Bearer $SOONER_API_KEY"

JSON

{
  "object": "list",
  "data": [
    {
      "id": "jk3p8m2x7c4v9n1b6q5w0e2r",
      "name": "marketing-site",
      "created_at": "2026-11-14T10:30:00.000Z"
    }
  ]
}

Revoke an API key

DELETE/api-keys/{id}

Revokes a key permanently. It returns 200 with an empty body.

Shell

curl -X DELETE https://api.sooner.dev/api-keys/jk3p8m2x7c4v9n1b6q5w0e2r \
  -H "Authorization: Bearer $SOONER_API_KEY"

Notable errors: not_found for an unknown key or a key that is already revoked.

With the Node SDK

TypeScript

import { Resend } from "resend";

const resend = new Resend(process.env.SOONER_API_KEY, { baseUrl: "https://api.sooner.dev" });

const { data } = await resend.apiKeys.create({ name: "marketing-site", permission: "sending_access" });
console.log(data?.token);