API key permissions let you control exactly what each API key can do in your Brevo account. Giving an integration only the access it needs means a compromised or shared key can't be used for anything else.
Good to know
- Keys created before permissions were available keep full access until you edit them.
- Permissions apply to API keys only. SMTP keys are not affected. To learn more, check our dedicated article Create and manage your SMTP keys.
Access types
When you create or edit an API key, you first choose how much of your account the key can reach:
- [Recommended] Restricted: you choose exactly what the key can reach. Every resource starts at None, so you only select a permission level for the resources the key needs.
- Full: the key can reach all current and future resources.
Permission levels
For each resource of a Restricted key, you choose one of four permission levels. The following table shows what each level allows:
| Level | What the key can do | API requests allowed |
|---|---|---|
| None | Has no access to the resource. | None |
| Read | Can view the resource but can't change it. | GET |
| Read/write | Can view, create, and update the resource but can't delete it. | GET, POST, and PUT |
| All | Has full access to the resource, including deleting. | All request types |
Available resources
You can set permissions on 18 resources. Not every resource offers every level. The following table shows the levels available for each resource:
| Resource | Available levels |
|---|---|
| Transactional email | None, Read, and All |
| Transactional SMS | None, Read, Read/write, and All |
| Transactional WhatsApp | None, Read, Read/write, and All |
| Email campaigns | None, Read, and All |
| SMS campaigns | None, Read, and All |
| WhatsApp campaigns | None, Read, and All |
| Contacts | None, Read, and All |
| Deals | None, Read, and All |
| Conversations | None, Read, Read/write, and All |
| Ecommerce | None, Read, Read/write, and All |
| Loyalty | None, Read, Read/write, and All |
| Events | None, Read, Read/write, and All |
| Objects | None, Read, and All |
| Account | None, Read, Read/write, and All |
| Webhooks | None, Read, Read/write, and All |
| Organization | None, Read, and All |
| Wallet | None, Read, Read/write, and All |
| Brevo Functions | None, Read, Read/write, and All |
Set permissions on an API key
To set permissions on a new key or edit the permissions of an existing key, check our dedicated article Create and manage your API keys.
What happens when a key doesn't have the required permission
If an integration makes a call that its key doesn't allow, Brevo blocks the call and returns an Access denied for resource error. To fix it, check our dedicated article Troubleshooting - Issues with API keys.
⏭️ What's next?
- Create and manage your API keys
- Troubleshooting - Issues with API keys
- Authorize and block IP addresses for API and SMTP security
🤔 ¿Tiene alguna duda?
Si tiene alguna pregunta, no dude en ponerse en contacto con nuestro equipo de asistencia mediante la creación de un ticket desde su cuenta. Si todavía no tiene una cuenta, puede ponerse en contacto con nosotros aquí.
Si necesitas ayuda con un proyecto usando Brevo, podemos ponerte en contacto con la agencia partner de Brevo adecuada.