Paubox has introduced scoped API keys, a single place to create, edit, and revoke API keys across Paubox Email API, Paubox Marketing, and Paubox Forms. Each key now carries explicit scopes that define exactly what it is authenticated to do. 

What's happening

Customers who build on more than one Paubox product asked for one consistent way to manage their keys. Scoped keys answer that. A key is now defined by its scopes, and to start, each scope maps to a product: Paubox Email API, Paubox Marketing, and Paubox Forms.

For example, if a developer sends transactional email through the Paubox Email API and also collects patient intake through Paubox Forms. They can issue one key scoped to both instead of tracking two separate credentials.

One rule to know: The Paubox Email API and Paubox Marketing scopes cannot share a single key. The Forms scope can be added alongside either one.

 

How it works

Manage every key from the unified settings page. When you create a key, you choose its scopes, and the domain picker filters automatically to match the scope you selected. On the key list, scope and domain filters help you find a specific key, and a search bar is coming shortly. Changes take effect immediately.

 

What stays the same

All existing API keys continue to work with no changes. There is no rotation and no action needed on your end. Both Token token= and Bearer authorization headers are still supported.

 

Why this matters

You have fewer credentials to track and clearer control over what each key can reach. As your integrations grow across products, key management stays in one place.