Authentication

Send an API key as a Bearer token and check which user it belongs to.

Create an API key on the API keys page and send it as a Bearer token on every request. Each key belongs to one team and has an access level. A Send only key can call POST /emails, POST /sends, and GET /users/me; every other endpoint returns 403 {error: forbidden}. Use it for apps that only send. The API keys page also lists your team id, for /api/v1/teams/… paths and the SDKs, and your cluster ids, for /clusters/… paths and X-Capsule-Cluster-Id. A team id in the path that does not match the key returns 404 {error: team_mismatch}. While an account is suspended, reads and deletes still work, but creating or changing clusters, IP pools, domains, tenants, SMTP credentials, inboxes, webhook endpoints, and templates returns 403 {error: team_suspended}.

GET /api/v1/users/me

Check that a key works and see the user it belongs to. The response does not include a team id. Copy that from the API keys page.

request.sh

1curl -sS -X GET \ 2 -H 'Authorization: Bearer YOUR_API_KEY' \ 3 https://app.postshiba.com/api/v1/users/me

response.json

1{ 2 "id": "UsErMe", 3 "email": "you@example.com", 4 "first_name": "Ada", 5 "last_name": "Lovelace", 6 "time_zone": "UTC", 7 "locale": null, 8 "created_at": "2026-09-11T12:00:00.000Z", 9 "updated_at": "2026-09-11T12:00:00.000Z" 10}