MailwurfAPI keys
One key per environment. Shown once, revocable at any time.
Tests authenticate with an API key. A key has access to all inboxes of its organization, and can send mail from them.
Create a key
Owners and admins can create keys.
- Open API keys.
- Enter a Key name (2–80 characters) that says where it is used, for example
local,GitHub Actions, orstaging nightly. - Optional: set Expires after days (1–365). Leave it empty for a key that does not expire.
- Select Create API key.
- Copy the key from Copy this key now.
The full key is shown only once. Mailwurf stores a fingerprint of it, not the key itself. If you lose it, create a new key and revoke the old one.
Keys look like mw_live_key_…. Send them as either header:
Authorization: Bearer mw_live_…
X-Api-Key: mw_live_…The key list
Organization keys shows every key with its name, the first characters of the key, and whether it is Active or Revoked, newest first. Keys past their expiry date stop working but are still listed as Active. Match the visible prefix against the start of the key in your CI secrets to find out which key a pipeline uses.
Revoke a key
Owners and admins can revoke keys.
- Select the trash icon next to the key.
- Confirm with Revoke key.
The key stops working immediately; requests with it return 401. Revoking cannot be undone. Create a new key and update the secret wherever the old one was used.
Recommendations
- Use a separate key for each developer machine and each pipeline, so one can be revoked without breaking the others.
- Give keys for temporary environments an expiry.
- Never put a key in browser code. In Cypress, call Mailwurf from tasks.
- Each key can hold four waits open at once. Parallel CI shards can use one key each.