API keys let you securely connect your website, application, or other tool to your Brevo account, so you can automate tasks like adding contacts, sending campaigns, or exporting data. You decide exactly what each key can access.

Good to know

• Only the account owner or users with the API keys permission can access the API Keys & MCP page, create a new API key, or delete an existing API key. To learn more about user permissions and permission levels, check our dedicated article Add users and assign permissions in Brevo.
• Whenever an API key is created or deleted from the account, the account owner will receive an email notification, including details such as the IP address and location.
• To see all the commands you can use with our API, check our API documentation.

Create an API key

When configuring an integration with your Brevo account, you may need to create a new API key and decide what it can access:

1. Click your account dropdown and select Settings > SMTP & API > API Keys & MCP.
2. Click Generate API key.
   
3. Enter the verification code sent to your device and click Verify. To learn more, check our dedicated article Verify your identity for sensitive actions in Brevo.
4. In Key name, name your API key. Make sure the name specifies which integration will use it so that you can easily recognize it.

5. In Expiry, select how long the key stays valid, from 7 days to 1 year, or choose no expiration.

   

   ❗️ Important

   Even with no expiration date, a key is deactivated if it hasn't made a successful API call in 90 days. You'll receive an email reminder 7 days before and on the day this happens. If you set an expiration date, you'll also receive a reminder 3 days before and on the day the key expires.

6. Under Access, choose how much of your account the API key can reach:

   [Recommended] Restricted Full

   With Restricted permissions, the key can only reach the resources you choose.

   Under Permissions, select None, Read, Read/write, or All for each resource the key needs. To learn more, check our dedicated article About API key permissions.

   

   With Full permissions, the key can reach all current and future resources, so there are no permissions to set.

   

7. Copy your API key and store it in a safe environment.
   

   ❗️ Important

   Your API key is only visible during this step. Once your API key is created, you won't be able to copy it anymore and you'll need to create a new one if you lose it.
8. (Optional) To generate a version of the API key that lets you connect an AI system to Brevo via the MCP protocol:
   1. Activate Create MCP server API key. The standard API key is deactivated and an MCP version of the API key is generated instead.
   2. Copy the MCP API key.
      
      To learn more, check our dedicated article What is Model Context Protocol (MCP)?. 
9. Click I've saved my key.

You have now successfully created a new API key.

View your API keys

To protect your API keys, existing keys are not visible from your Brevo account. The API Keys & MCP page only displays the last digits of each key so that you can tell several keys apart:

The page also shows the following information for each key:

• Name: the name of the key and its last digits. Keys with an MCP version display an MCP label. 

  💡 Good to know

  If you see a warning icon next to a key name, this means the key has expired.
• Permissions: 
  • Full access means the key can reach all resources. 
  • Restricted followed by a number of scopes means the key can only reach that number of resources. Hover over the permissions to see which resources the key includes.
• Status: whether the key is active or deactivated.
• Expires on: the date the key expires, or No fixed date if you didn't set an expiration date.
• Last used on: the date of the last API call made with the key.

Edit an API key

If an integration needs more or less access than you first gave it, you can change the access of its API key at any time. You can also edit the name and the expiration date of the key.

1. Click your account dropdown and select Settings > SMTP & API > API Keys & MCP.
2. Next to the API key you want to edit, click the three-dots icon and select Edit API key.
   
3. Enter the verification code sent to your device and click Verify. To learn more, check our dedicated article Verify your identity for sensitive actions in Brevo. 

4. Make the necessary changes. 

   ❗️ Important

   If you remove a permission that an integration still needs, its API calls fail with an Access denied for resource error. To learn more, check our dedicated article Troubleshooting - Issues with API keys
5. Click Save changes. 

You have now successfully updated your API key.

Deactivate or reactivate an API key

If you want to temporarily pause the usage of an API key instead of deleting it completely, you can deactivate it and reactivate it later when you need it again. You can also reactivate a key that was deactivated.

1. Click your account dropdown and select Settings > SMTP & API > API Keys & MCP.
2. Next to the API key you want to deactivate or reactivate, click the three-dots icon and select Deactivate API key or Activate API key.
   

You have now successfully deactivated or reactivated your API key.

Delete an API key

If your account has been compromised or if you no longer use an integration that requires a particular API key, you can delete that API key:

1. Click your account dropdown and select Settings > SMTP & API > API Keys & MCP.
2. Next to the API key you want to delete, click the three-dots icon and select Delete API key.
   

You have now successfully deleted your API key.

Best practices with API keys

Protect every API key in the same way as a password. Here are a few best practices to keep in mind:

• Use a different API key for each integration and include the name of the integration in the name of the key. That way, if a key is compromised, you can delete it without impacting your other integrations.
• Use Restricted access and give each key only the permissions it needs. That way, a compromised key can only reach the resources you selected.
• Store your API keys in a safe environment, not in a Word document or post-it note.
• Don't expose your API key to the public. Hide your API key, or even better, cut it completely in screenshots or videos.
• Never send an API key via email, as this gives access to your Brevo account if someone hacks your email account.
• Always delete API keys that are no longer used to limit the risks of leaks.
• Activate IP address blocking so API calls from unrecognized IP addresses are blocked until you authorize them. To learn more, check our dedicated article Authorize and block IP addresses for API and SMTP security.

⏭️ What's next?

• About API key permissions 
• Troubleshooting - Issues with API keys
• Create and manage your SMTP keys
• Authorize and block IP addresses for API and SMTP security
• My account has been compromised, what should I do?
• What is Model Context Protocol (MCP)?

🤔 Have a question?

If you have a question, feel free to contact our support team by creating a ticket from your account. If you don't have an account yet, you can contact us here.

If you’re looking for help with a project using Brevo, we can match you with the right certified Brevo Agency partner.