MailSlurp API access requires an API key in the `x-api-key` header. This guide focuses on secure setup patterns, not just copy-paste examples.

## 1) Create or access your account

Sign up or log in:

- [Create account](https://app.mailslurp.com/sign-up/)
- [Login](https://app.mailslurp.com/login/)

![MailSlurp login](/assets/login-screen.jpg)

## 2) Find your API key

After login, open the dashboard and copy your key from the API section.

![MailSlurp API key](/assets/api-key.jpg)

## 3) Store keys by environment

Do not hardcode keys in source files.

Recommended layout:

- local development: shell environment variable
- CI: secret store (GitHub Actions, CircleCI contexts, etc.)
- production services: cloud secret manager + rotation policy

```bash
export MAILSLURP_API_KEY="your-key"
```

## 4) Use the key in HTTP requests

```bash
curl -sS -X POST "https://api.mailslurp.com/inboxes" \
  -H "x-api-key: ${MAILSLURP_API_KEY}" \
  -H "Content-Type: application/json"
```

If you receive `401` or `403`, first verify key source and environment injection.

## 5) Configure SDK clients

Most SDKs use the same header under the hood.

Node.js example:

```ts
import { MailSlurp } from "mailslurp-client";

const mailslurp = new MailSlurp({
  apiKey: process.env.MAILSLURP_API_KEY,
});

const inbox = await mailslurp.createInbox();
console.log(inbox.emailAddress);
```

More SDK references: [developer docs](/docs/).

## Security checklist

- rotate keys on a schedule and after team changes
- keep separate keys for local, CI, and production systems
- scope usage per service where possible
- redact keys from logs and error messages
- audit old or unused keys regularly

## Common mistakes

### Using the wrong header name

Use `x-api-key` (not `Authorization: Bearer ...` unless a specific SDK layer requires it).

### Checking keys into git

If a key is exposed, rotate it immediately and clean affected history where necessary.

### Sharing one key across all systems

Split keys by environment so revocation and incident handling are safer.

## Related guides

- [Sign up and account setup](/guides/signing-up/)
- [Developer overview](/about/developers/)
- [SMTP and IMAP access guide](/guides/smtp-imap/)