Integrations and API keys

An integration identifies the application you connect to Sendiro. Its API keys can act within one workspace using defined permissions, without using a team member’s personal session.

Open Settings → Developers. View integrations and diagnostics, Configure integrations and webhooks, and Manage API keys control access to these tools. Developer includes technical configuration, domains and senders, sending status and usage. Direct access to contacts, broadcasts, automations, team and billing is assigned separately.

Create the integration first

Under Create integration, enter a recognizable name and select its permissions. A sync that only reads contacts, for example, does not need permission to send email or delete contacts.

Integration permissions define the maximum its keys can receive. Anyone who can configure integrations can choose that scope from the available API permissions, even without access to the corresponding dashboard features. For example, a developer can configure an application’s transactional sending without viewing contacts in Sendiro.

Managing keys allows permissions within the integration’s scope, without expanding it. This is sensitive access: it allows the creation of credentials the application can use. Choose only the permissions the connection needs.

Issue and store the key

1. Under Create API key, choose the integration.
2. Add a name that identifies the system using the key.
3. Select the permissions needed from those allowed by the integration.
4. Create the key and use Copy key to store it in your application’s secret store.

The secret appears in the creation result and is not shown again in the list. If you lose it, create a replacement. The list retains its name, prefix, status and permissions to help you identify it.

Do not put the key in browser code, repositories, images or shared messages. Anyone holding it can perform the operations its permissions authorize.

Replace or revoke a key

To rotate a key, create a new one, update the application using it and check that it works. Then revoke the old key from its details.

Revocation prevents newly authorized operations with that key. It does not undo completed operations or confirm cancellation of a send that has already started.

Integrations and keys belong to the workspace. Suspending their creator does not delete them or cancel accepted work: revoke the key or disable the integration explicitly when appropriate. Every new operation checks key status, the current integration ceiling and the allowed machine scopes. Reducing that ceiling blocks future operations outside it; credentials are not implicitly deleted. Keys cannot administer the team or billing and do not replace quota, consent or authorized sender requirements.

Technical diagnostics expose bounded metadata; they do not grant recipient, content or sensitive payload access. Recovering a job is a separate capability with possible sending and data effects and also requires permission for those effects.

Inspect events and understand this screen

The page shows automation events when you have permission to view individual activity. Developer does not include that access. These external events are different from email delivery events, which you can inspect through the API during beta.

The Webhooks section does not yet include a configuration form. Administration is available through the API with a user session; it is not configured on this screen or an administrative capability of integration keys.