Authentication & Authorization

All SendClean API requests require authentication to ensure security and proper access control. Authentication is performed using a combination of credentials that uniquely identify your account and verify your permissions.

Required Authentication Parameters

Parameter	Type	Required	Description
owner_id	String	Yes	Your unique account identifier provided during account creation. This ID is permanent and identifies your SendClean account.
token	String	Yes	Your API authentication token. This is a secret key that verifies your identity. Keep this secure and never share it publicly.
smtp_user_name	String	Conditional	Required for email sending operations. This identifies which SMTP user credentials to use for sending the email.

Security Best Practices

Follow these practices to keep your SendClean API credentials secure.

Best practice	What to do	Why it matters
Keep tokens server-side	Store your API token only on your server. Do not include it in browser JavaScript, mobile apps, or any code that runs on user devices.	Client-side code can be inspected, which can expose your token publicly.
Use HTTPS	Send all API requests over HTTPS.	HTTPS encrypts credentials and request data in transit.
Rotate tokens periodically	Rotate API tokens every 90 days using the token management APIs.	Regular rotation reduces the impact of a leaked or compromised token.
Use environment variables	Store `owner_id`, `token`, and `smtp_user_name` in environment variables or a secure configuration system.	This keeps credentials out of your source code and version control.
Implement rate limiting	Monitor API usage and apply rate limits in your application.	Rate limiting helps prevent abuse and unexpected traffic spikes.