Authentication

The Templated API supports two authentication methods:

• API keys (recommended for integrations) — a bearer token for server-to-server access
• Session cookies — set automatically when signed into the web app; used by the app itself

API keys

Create a key in the app under Integrations → API Keys. The key is shown once at creation — store it in your secrets manager.

Keys look like tmpl_sk_ followed by 40 hex characters. Send them in the Authorization header:

curl https://app.templated.email/api/accounts/{slug}/templates \
  -H "Authorization: Bearer tmpl_sk_your_key_here"

Scope and permissions

• A key belongs to one account and only works on that account's endpoints — requests against any other account return 403 (KEY_ACCOUNT_MISMATCH).
• Keys act with editor permissions: create and edit templates, export, generate with AI, push to ESPs. They cannot manage billing, members, account settings, or other API keys.
• Up to 5 active keys per account. Available on every plan.

Key management

Keys are managed in the app UI, or via these endpoints (session auth only — a key cannot manage keys):

Security notes

• Only a SHA-256 hash of your key is stored; lost keys cannot be recovered — revoke and re-create.
• Revoke any key you suspect is leaked; revocation is instant.
• The Last used timestamp in the UI helps you spot stale or unexpected usage.

Session authentication

When a user signs in through the Templated web app, a session cookie (NextAuth.js) is set automatically. Same-origin API calls from the browser are authenticated transparently. A few endpoints — registration, sign-in, billing, member and key management — accept session auth only.

Sign in

POST /api/auth/callback/credentials
Content-Type: application/x-www-form-urlencoded

email=user@example.com&password=your-password

Register a new account

POST /api/auth/register
Content-Type: application/json

{
  "name": "Jane Smith",
  "email": "jane@example.com",
  "password": "secure-password-here"
}

After registration, verify your email using the link sent to your inbox.

Account context

Most API endpoints are scoped to an account. You access them using the account's slug:

GET /api/accounts/{slug}/templates

With session auth you must be a member of the account; with an API key the key must belong to it.

Error responses