Management credential required

Automate account resources with exact scopes.

Custom plans can create up to five named mg_live_… keys in Dashboard → API Keys; Free has zero Management API key capacity. Each secret is displayed once and is individually revocable. Management keys cannot send or inspect email.

Exact six scopes

`account:read`	Account identity, plan, and entitlements.
`usage:read`	Resource, queue, and rolling email usage.
`domains:read`	Domain collections, detail, and DNS records.
`domains:write`	Create/delete domains and initiate DNS checks.
`senders:read`	Nested collections and sender detail.
`senders:write`	Create, update, and delete senders.

Write does not imply read. There are no billing, plan-change, credential-management, account-deletion, or separate DNS scopes.

Account endpoints

GET /v1/account requires account:read. GET /v1/account/usage requires usage:read. The latter reports domains, senders, active queue occupancy, and rolling minute/hour/day email submissions against effective limits.

Pagination and isolation

Management collections use stable ascending creation order. limit defaults to 50 and accepts 1–100; pass opaque next_cursor values unchanged. All identifiers and external_id values are account-scoped. Malformed, unknown, deleted, or foreign resources return the same safe not-found response.

Authorization example

Request header

Authorization: Bearer $TENVIO_MANAGEMENT_KEY