Secure transactional email API keys by restricting them to the sending scope and specific domains, rotating them immediately on staff changes or suspected leaks, and storing only the hash while keeping the full secret in a secrets manager. ArawaMail returns the full key once at creation, stores a prefix plus SHA-256 hash, supports only the sending scope, and updates last_used_at on every successful call so you can audit usage.
Why API Key Security Matters for Transactional Email
A leaked sending key lets an attacker send mail that appears to come from your domain. That burns domain reputation, triggers spam complaints, and can violate bulk-sender rules from Gmail and Yahoo. Unlike a mailbox password, an API key often lives in CI/CD, server environment variables, or shared repos long after the person who created it has left. Treat every sending credential as equivalent in power to the From address it can use.
Related reading: SMTP vs Email API explains when to prefer the API, and Employee Email Offboarding covers the people-process side of credential rotation.
How ArawaMail API Keys Work
ArawaMail issues long random secrets that look like your_api_key_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. The full value is shown only at creation time. The platform stores the prefix and a SHA-256 hash; it never retains the plaintext. Keys support a single scope today: sending. A sending key can call the public send endpoints but cannot log into the dashboard.
You can leave a key unrestricted across all company domains or restrict it to one domain. Restricted keys will only accept From addresses that belong to the chosen domain. Every successful authenticated request updates the key’s last_used_at timestamp, giving you a simple audit trail.
See the official docs for the current contract: API Keys and the Transactional Email overview.
Scoping for Least Privilege
- Create a separate key per application or environment (production, staging, CI).
- Prefer domain-restricted keys whenever the sending domain is known.
- Never reuse a key across unrelated products or client accounts.
- Document which key belongs to which service so rotation does not become guesswork.
Rotation Playbook
Rotate a key when:
- An employee who had access leaves (see the offboarding guide).
- A key appears in a commit, screenshot, or shared channel.
- last_used_at shows unexpected activity from an unfamiliar IP or user-agent.
- You are moving from unrestricted to domain-restricted.
Steps: create the new key, update secrets in your deployment system, deploy, confirm sends succeed, then delete the old key. Keep the overlap window as short as your rollback needs allow. Because ArawaMail never stores the plaintext, you cannot recover a lost key—rotation is the only recovery path.
Storage and Secret Hygiene
Store the full key only in a secrets manager (AWS Secrets Manager, HashiCorp Vault, GitHub Actions secrets, etc.). Never commit it, never paste it into tickets, and never log it. In Laravel, use config('services.arawamail.key') loaded from the environment; never hard-code it. The platform’s hash-only storage already protects the server side; your job is to protect the client side.
How We Analyzed This
Guidance is drawn from the current ArawaMail API Keys documentation (scope, domain restriction, hash storage, last_used_at) and from the published offboarding article that already treats sending keys as first-class credentials. No unsupported features (such as automatic rotation or multi-scope keys) are claimed.
FAQ
Can an ArawaMail API key log into the dashboard?
No. Current keys support only the sending scope and cannot authenticate to the dashboard.
What happens if I lose the key after creation?
You cannot retrieve it. Create a new key, update your systems, and delete the old one.
Should I use one key for all domains?
Only if you intentionally want unrestricted access. Prefer domain-restricted keys for least privilege.
How do I know if a key is still in use?
Check last_used_at and the Sent folder for API-originated messages. Absence of recent activity is a good signal that a key can be safely removed.