API keys, permissions and team

Create an API key

In API keys > Create key, give it a name (for instance “Production server”) and pick its permissions:

• Full access: manage mailboxes and webhooks, send and read.
• Send only: only send emails and replies.
• Read only: only read messages, events and usage.

Give each application the most restricted key possible: for instance Send only for a service that only sends emails. The key goes in the Authorization: Bearer smz_live_… header and must never be exposed in a browser or a mobile app.

Revoke a key

The Revoke button disables the key immediately. The last-used date shown next to each key helps spot the ones no longer in use.

Invite your team

In Settings & team, invite colleagues by email. There are three roles:

• Member: manages mailboxes, webhooks, templates and messages.
• Admin: like Member, plus API keys and members.
• Owner: like Admin, plus billing and deleting the organization.