---
title: Authentication
slug: authentication
description: Every request is authenticated with a project API key sent in the x-api-key header.
order: 1
updatedAt: '2026-08-14'
---

## The header

Send your key in `x-api-key` on every request:

```
x-api-key: sf_live_xxxxxxxxxxxxxxxxxxxx
```

There is no OAuth flow and no bearer token. A request without a valid key gets
`401`.

## Keys belong to a project

A key is created inside a project and can only send templates that belong to
that same project. If you pass the id of a template from another project, the
API answers `404`, not `403` — it does not reveal whether that id exists
somewhere else.

That makes the project the unit of isolation: one key per project, and a leaked
key never reaches the templates of the rest.

## Live and test keys

Keys carry an environment, visible in their prefix:

| Prefix | Environment | Use it for |
|---|---|---|
| `sf_live_` | live | Real sends from production. |
| `sf_test_` | test | Integration work, staging and local development. |

Both prefixes hit the same endpoint. Keeping them apart is what stops a
half-finished integration from emailing your real customers.

## How keys are stored

SentFast stores a SHA-256 hash of the key, plus its prefix and last four
characters so you can recognise it in the dashboard. The full value is shown
once, at creation, and cannot be recovered afterwards. If you lose it, create a
new key and revoke the old one.

## Keeping keys safe

- Keep the key on your server. Anything shipped to a browser or a mobile app is public.
- Read it from an environment variable, never from a literal in the repository.
- Revoke a key the moment you suspect it is exposed. Revoking takes effect immediately.
- Rotate by creating the new key first, deploying it, and revoking the old one after.

```js
// Node.js
const res = await fetch('https://sentfa.st/api/v1/email/send', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': process.env.SENTFAST_API_KEY,
  },
  body: JSON.stringify({ id: 'em_a1b2c3d4', to: 'customer@example.com' }),
});
```