Notify
Sign in

Authentication & API Keys

Authenticate Notify API requests with the x-api-key header.

Every Notify API request requires an API key in the x-api-key header. Generate your first key from the dashboard checklist or the Credentials page.

Create and retrieve your API key

Generate a key, copy it when it’s shown, and store it in an environment variable:

NOTIFY_API_KEY=your_api_key_here

Never expose API keys in client-side code or version control.

Using your API key

Pass the key on every request:

await fetch('https://notify.cx/api/email/send', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': process.env.NOTIFY_API_KEY!
  },
  body: JSON.stringify({
    to: 'recipient@example.com',
    subject: 'Hello world',
    message: 'Your email content here',
    from: 'noreply@your-verified-domain.com'
  })
});

Missing or invalid keys return 401 Unauthorized.

Regenerate a key

If a key is compromised, regenerate it immediately:

  1. Go to Credentials
  2. Click Regenerate API Key
  3. Update every application that uses the old key

The old key is invalidated immediately.

Regenerate via API

curl -X POST https://notify.cx/api/email/api-keys/regenerate \
  -H "Content-Type: application/json" \
  -H "x-api-key: your_api_key" \
  -d '{
    "keyId": "123e4567-e89b-12d3-a456-426614174000"
  }'

Response:

{
  "success": true,
  "message": "API key regenerated successfully. Make sure to update your x-api-key header.",
  "data": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "api_key": "new-api-key-value"
  }
}

List keys via API

curl -X GET https://notify.cx/api/email/api-keys \
  -H "x-api-key: your_api_key"

List responses return key metadata and a prefix only — not the full secret.

Security best practices

  • Store keys in environment variables or a secrets manager
  • Never call the Notify API from browser code
  • Regenerate compromised keys immediately
  • Rotate keys during low-traffic periods and test afterward

Next steps