API keys
Every request carries the api-key header, exactly like Brevo:
GET /api/brevo/v3/account HTTP/1.1
Host: my-shop.com
api-key: xkeysib-3f2a…
curl -s "https://my-shop.com/api/brevo/v3/account" -H "api-key: $BREVO_API_KEY"
- One key = one Brevo account = one site. All data (contacts, lists, templates, logs, webhooks) belongs to that site; a key never sees another site's data, even within the same tenant.
- Keys use Brevo's format (
xkeysib-+ 64 hex characters +-+ 16 alphanumeric characters) so plugins' format checks pass. - Only a SHA-256 fingerprint is stored: the key is shown once, at creation. A lost key cannot be recovered; create a new one.
- The domain in the URL does not identify the account: the key does. Prefer a domain of the site concerned.
Getting and managing a key
Keys are issued by a platform administrator: ask your Inklura administrator for one, giving the site concerned and a name for the key (for example "WordPress"). A site can have several keys, for instance one per tool, so you can revoke one without cutting off the others.
For each key, the platform keeps:
| Field | Detail |
|---|---|
| Name | label chosen at creation |
| Prefix | xkeysib- followed by the first 8 characters, to recognise the key without exposing it |
| Created | creation date |
| Last used | date of the last authenticated request, updated at most once a minute |
| Revoked | revocation date, if any |
Keys do not expire on their own. A revoked key answers 401 from the next request on;
revocation is permanent.
Warning
Never put a key in code that runs in your visitors' browsers: it grants access to the site's contacts and email sending.
Authentication errors
| Status | Body | Cause |
|---|---|---|
401 |
{"code":"unauthorized","message":"Key not found"} |
missing header, unknown or revoked key |
The key is checked before anything else: a request without a valid key gets this 401 even
if the path does not exist or does not accept that method.