API keys

An API key lets a tool outside MailMoose reach your mail. Keys are how scripts, assistants, and future integrations connect.

A key acts as you. It can reach exactly the mailboxes you can reach and nothing more, so a key never grants more access than you already have.

Create a key

1. Go to Settings, then API keys in its sidebar, or open the menu under your avatar and choose API keys directly.
2. Give the key a name that says where it will live, for example "Claude Code on my laptop". You will thank yourself later.
3. Choose its permissions. Start with Read mail only, and add more when you need them.
4. Choose when it expires. Ninety days is a good default.
5. Select Create key.

The key is shown once, at that moment. Copy it straight into wherever it is going. MailMoose stores only a scrambled version, so nobody, including us, can show it to you again. If you lose it, revoke the key and make another.

Permissions

Give a key the least it needs. A tool that only summarises your inbox has no reason to be able to send.

Limits that protect you

• 100 sends per API key or agent connection by default. You can choose a custom limit when creating a key.
• 1,000 sends per organization by default, shared across all users, domains, keys, and agent connections.

Both limits count the previous 24 hours, not a calendar day. Each send counts as one message, including replies. Manual sends use only the organization allowance; sends through a key use both. More keys do not increase the organization limit.

When a limit is reached, sending is blocked until older sends leave the 24-hour window. Receiving mail does not use these allowances. See your organization’s limit under Settings → Organization.

Two further limits apply automatically:

1. Replies cannot be redirected. A reply is always addressed using the conversation's own records, so a tool cannot change who a reply goes to.
2. First contact needs confirming. Sending to an address you have never corresponded with is refused until the request explicitly confirms it.

Keep keys safe

1. Treat a key like a password. Anyone holding it can read what you can read.
2. Use a separate key for each tool, so you can revoke one without disturbing the others.
3. Prefer keys that expire.
4. Revoke immediately if you suspect a key has leaked. Revocation takes effect on the next request.
5. Never paste a key into a shared document, a screenshot, or a support ticket.

Revoke a key

Go to Settings, then API keys, find it in the list, and select Revoke. Anything using that key stops working straight away. Revoking cannot be undone, but creating a replacement takes seconds.