---
title: "Authentication, MailKaro Docs"
description: "Authentication in MailKaro: the Cloud API authenticates with a secret server key, scoped to its organization."
---

# Authentication

Rendering

# Authentication

The Cloud API authenticates with a secret server key, scoped to its organization.

bash

```
Authorization: Bearer sk_live_… # or ?token=sk_live_…
```

`POST /v3/render` and `POST /v3/import` are public (they only work on what you send, no stored data). The [templates, webhooks and emails](https://docs.mailkaro.com/cloud-api) endpoints require a server key, which stays on your backend. A publishable `pk_live_…` token is refused there, because it is visible in your frontend; an invalid or inactive key returns `401`.

## Which key works where

- `sk_live_…` server key: every `/v3` route. Keep it on your backend.
- `pk_live_…` publishable token: the browser editor only. `/v3` refuses it, and also refuses an older token that has no key type.
- No key: `POST /v3/render` and `POST /v3/import`.

A missing, unknown, inactive or publishable key gets `401` with `{ "error": "invalid_token" }`.

## Getting and storing the key

A new server key is shown in full only once, when you create it (see [embed tokens](https://docs.mailkaro.com/embed-tokens)). Later reads show it masked, so save it to your secret store right away. Use the `?token=` form only where you cannot set a header, such as a provider's webhook URL for [delivery events](https://docs.mailkaro.com/delivery-events).

## Rate limits

Every `/v3` response carries `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` and `RateLimit-Policy` headers, counted per key (or per IP when there is no key). Over the limit you get `429` with a `Retry-After` header.

Source: https://docs.mailkaro.com/authentication