> ## Documentation Index > Fetch the complete documentation index at: https://docs.wazobiamail.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create a scoped sending key > Creates a send-only key. scope is general (default) or domain. A domain key requires domainId of a verified sending domain. Domain-specific keys require an active or trialing Business or Enterprise subscription for creation, regeneration and authentication. Purchased credits alone do not unlock them. Use the secret as x-api-key; it only authorizes message sending and attachment upload, not account, domain, mailbox, tracking or key management. A matching content.from selects an active hosted mailbox or connected Gmail mailbox. Otherwise the first eligible mailbox is selected; domain keys restrict selection to that exact domain. If no mailbox is available in scope, the platform sender is used. Explicit display names are retained. Reply-To defaults to the effective sender unless content.replyTo is supplied. The secret is returned once. ## OpenAPI ````yaml /customer-openapi.json post /sending/api-keys openapi: 3.1.0 info: title: WazobiaMail API version: 1.0.0 description: >- Customer-facing WazobiaMail API. Base URL https://app.wazobiamail.com/api/v1. Every response uses the {success, message, data} envelope. This specification covers the integration API: API-key and public operations. Sign-in, registration, password reset and account settings are supported in the app and are not listed here, although a dashboard key can call the account operations. The dashboard key carries wildcard permissions; the scoped sending key documented below can only send. Customer responses omit internal email providers, tenant/queue routing, raw upstream payloads and stored service credentials. See /guides/api-responses for the response contract and migration guidance. Download the OpenAPI specification at https://wazobiamail.com/openapi.json. API-owned JSON response field names use camelCase, including pagination; user-defined data and third-party protocol payloads retain their own keys. contact: name: WazobiaMail Support url: https://wazobiamail.com/contact servers: - url: https://app.wazobiamail.com/api/v1 security: - apiKey: [] tags: - name: Account description: >- Profile, password, two-factor, notifications and account data. Account status, plan, units and health. - name: Sending description: Sending API keys, messages, domains, SMTP access and engagement. - name: Mailboxes description: Hosted mailboxes and their credentials. - name: Relays description: Customer SMTP relay configurations. - name: Billing description: Plans, subscriptions, invoices, payments and email credits. - name: Plans description: >- Plan catalogue entitlements and the effective limits of the current account's plan. - name: Support description: Support tickets. paths: /sending/api-keys: post: tags: - Sending summary: Create a scoped sending key description: >- Creates a send-only key. scope is general (default) or domain. A domain key requires domainId of a verified sending domain. Domain-specific keys require an active or trialing Business or Enterprise subscription for creation, regeneration and authentication. Purchased credits alone do not unlock them. Use the secret as x-api-key; it only authorizes message sending and attachment upload, not account, domain, mailbox, tracking or key management. A matching content.from selects an active hosted mailbox or connected Gmail mailbox. Otherwise the first eligible mailbox is selected; domain keys restrict selection to that exact domain. If no mailbox is available in scope, the platform sender is used. Explicit display names are retained. Reply-To defaults to the effective sender unless content.replyTo is supplied. The secret is returned once. requestBody: required: true content: application/json: schema: type: object required: - name properties: name: type: string minLength: 2 maxLength: 120 example: Billing worker scope: type: string enum: - general - domain default: general description: >- general selects from account mailboxes; domain restricts selection to one verified domain and requires an active or trialing Business or Enterprise subscription. domainId: type: string description: >- Required when scope is domain. Use the id of a verified sending domain. expiresAt: type: string example: '2027-01-31T23:59:59' description: Optional expiry timestamp. Expired keys return 401. responses: '201': description: >- Key created. data.apiKey contains the secret once, plus id, name, scope, domainId, keyPrefix and expiresAt. content: application/json: schema: $ref: '#/components/schemas/Envelope' '400': description: >- `domainId` is missing for a domain-scoped key, or the domain is not verified for sending. '401': description: >- Missing, invalid, expired or revoked key, or a sending key (which is not accepted on this operation). '403': description: >- The key lacks sending:keys:write permission, or domain scope requires an active or trialing Business or Enterprise subscription. '404': description: Unknown domain id for this account. '422': description: Name, scope or field validation failed. content: application/json: schema: $ref: '#/components/schemas/ValidationError' security: - apiKey: [] components: schemas: Envelope: type: object required: - success - message - data properties: success: type: boolean example: true message: type: string example: Done data: description: Payload; shape depends on the endpoint. ValidationError: type: object description: Validation failure. `errors` is keyed by field name. required: - success - statusCode - message - errors properties: success: type: boolean example: false statusCode: type: integer example: 422 message: type: string example: Validation failed errors: description: Field name to the failure text recorded on it. type: object additionalProperties: type: string example: content.from: >- This account is not authorized to send from this email address. Connect its Gmail account, verify your sending domain, or omit content.from to use the platform sender securitySchemes: apiKey: type: apiKey in: header name: X-API-Key description: >- Dashboard API key created at https://app.wazobiamail.com/dashboard/smtp-api. Send operations also accept a narrower sending key created through POST /sending/api-keys; every other operation needs the dashboard key. x-default: YOUR_API_KEY ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.