Authentication

Every request to the Arsel API must include a valid API key. Keys are scoped to your organization, so all usage and rate limits apply at the organization level.

REST vs SMTP

This page covers authentication for the REST API (API keys). If you're connecting to the SMTP server, you use a separate SMTP credential (username + password) instead — see Managing SMTP Credentials. The two credential types are independent and cannot be used interchangeably.

Credential Types

Arsel issues two kinds of credential. The prefix tells you which one you are holding, and — more importantly — whether it is safe to ship to a browser or a mobile app.

Prefix	Name	Secret?	Where it belongs	Used for
be_	API key	Yes	Your server only	The whole REST API
pub_	Client key	No — publishable	Shipped in web/mobile app code	Client SDKs: event ingestion and device registration

Everything on this page describes the be_ API key unless stated otherwise.

API Key Format

be_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The be_ prefix identifies the key type; the remaining 32 characters are cryptographically random.

Sending Authenticated Requests

Include your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer be_your_api_key_here

Header	Value	Required
Authorization	Bearer <your-api-key>	Yes
Content-Type	application/json	Yes

Generating API Keys

1. Log in to your Arsel Dashboard
2. Navigate to Settings > API Keys
3. Click Create API Key and give it a descriptive name
4. Copy the key immediately — it is only shown once

warning

Store your API key securely. It cannot be retrieved after creation. If you lose it, revoke the old key and generate a new one.

Key Lifetime

Every API key expires one year after it is created. The expiry is fixed at creation and cannot be extended, so build rotation into your schedule rather than discovering it when sends start returning 401. The dashboard shows each key's expiry alongside its last-used timestamp.

To rotate with no downtime: create the new key, deploy it, confirm traffic has moved by watching the old key's last-used timestamp, then revoke the old key.

Key Management

From the dashboard you can view all active keys with their expiry and last-used timestamps, revoke keys you no longer need, and create replacements.

Security Best Practices

• Never expose be_ API keys in client-side code. They grant your whole organization and are for server-to-server communication only. If you need to send events or register devices from a browser or mobile app, use a pub_ client key instead — it is designed to ship in client code and can do far less. See Client SDKs.
• Use environment variables to store keys, not source code.
• Rotate keys periodically and immediately if a key may have been compromised.
• Use separate keys for development and production environments.

Authentication Errors

If your API key is missing, invalid, or revoked, the API returns:

{
  "status_code": 401,
  "name": "unauthorized",
  "message": "Invalid or missing API key"
}