Authentication

Deckle issues secret keys only — there are no public or publishable keys, because a send API has no safe client-side scope. Treat every key like a password.

The Authorization header#

Pass your key in the Authorization header. The API rejects requests without a valid secret key with 401 Unauthorized.

curl https://app.getdeckle.com/api/v1/contacts \
  -H "Authorization: Bearer sk_live_9a8b7c6d..."

Test and live keys#

Keys are prefixed by environment: sk_test_ and sk_live_. A test key is sandboxed — it can only send to the AWS SES simulator or your own verified domains, and it cannot run campaign sends. A live key sends to real recipients. Everything else (contacts, templates, automations) behaves the same in both environments, scoped to the same project.

sk_test_1f4c...   # sandboxed: simulator + verified domains only
sk_live_9a8b...   # real inboxes

Managing keys#

Create and revoke keys in the dashboard under Developers → API keys. The full key is shown once at creation; Deckle stores only a SHA-256 hash and a masked prefix, so it can never show you the key again. The same secret key is also your SMTP password.