> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wazobiamail.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in through the app; use the one API key for everything else.

# Authentication

Two credentials, two jobs:

| Credential | Header | Used for |
| - | - | - |
| Access token (JWT, 15 minutes) | `Authorization: Bearer <accessToken>` | Signing in and dashboard sessions |
| API key | `X-API-Key: YOUR_API_KEY` | Every API operation: sending, domains, mailboxes, attachments, tracking and more |

Signing in always happens in the app — email and password, one-time code,
magic link, or the Google/GitHub buttons on the
[login page](https://app.wazobiamail.com/login). The app keeps your session
alive and refreshes it for you. Create the API key in your dashboard while
logged in (see [API keys](/docs/guides/api-keys)). Services and scripts use the
key; browsers use the login session.

Accounts with two-factor authentication confirm with a code at sign-in.
Several failed password attempts lock sign-in briefly.

## Sessions

Review your active sessions in the dashboard security settings and revoke any
you do not recognise. Signing out there ends the session.

## Which credential where

Every data endpoint in these guides takes `X-API-Key`. Sign-in, session and
password flows live in the app, never in integration code.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.