Brevo Authentication: API Key & SMTP Setup (2026)

Authentication overview

Authentication for Brevo APIs and services ensures that only authorized applications and users can interact with your Brevo account. Brevo supports two primary authentication mechanisms: API keys for general API access and SMTP credentials for sending transactional emails through an SMTP client. These methods enable secure communication with Brevo's infrastructure, facilitating operations such as sending emails, managing contacts, and automating marketing workflows.

Proper authentication is crucial for maintaining the security and integrity of your data within the Brevo platform. It prevents unauthorized access to your email lists, campaign data, and sending capabilities. Developers integrating with Brevo must understand the specific requirements for each authentication method and implement them according to security best practices to protect sensitive information and prevent misuse of their accounts.

Brevo provides comprehensive documentation and client libraries across various programming languages, including Node.js, Python, PHP, Ruby, Java, and Go, to assist developers in implementing these authentication methods efficiently. These resources often include examples and guidelines for securely handling credentials and making authenticated requests to the Brevo API and SMTP servers.

Supported authentication methods

Brevo primarily offers two distinct methods for authentication, each tailored to specific use cases:

1. API Keys: These are unique alphanumeric strings used to authenticate requests to the Brevo REST API. API keys grant access to various API endpoints for managing contacts, sending campaigns, accessing statistics, and more. They are suitable for server-to-server communication and applications that require broad access to Brevo's features. Brevo's API keys are generated within the user's account dashboard and are associated with specific permissions. More details on API key usage are available in the Brevo API keys documentation.
2. SMTP Credentials: These consist of a username (typically your Brevo email address) and a password, specifically for authenticating with Brevo's SMTP server. SMTP credentials are used when sending transactional emails directly through an SMTP client or library, bypassing the need for the Brevo REST API for email sending itself. This method is ideal for applications that already have an SMTP sending mechanism in place and wish to route emails through Brevo for deliverability and tracking.

The choice between API keys and SMTP credentials depends on the specific integration requirements. For most programmatic interactions with Brevo's features beyond simple email sending, API keys are the standard approach. For direct email sending via an SMTP server, SMTP credentials are required.

Authentication Methods Comparison

Getting your credentials

To integrate with Brevo, you will need to obtain the appropriate credentials from your Brevo account dashboard. The process varies slightly depending on whether you need API keys or SMTP credentials.

Obtaining API Keys

1. Log in to your Brevo account: Access your Brevo dashboard.
2. Navigate to SMTP & API: In the left-hand navigation, locate and click on 'SMTP & API'.
3. Generate a new API key: If you don't have an existing key or wish to create a new one, click on the 'Create a new API key' button.
4. Name your API key: Assign a descriptive name to your API key to easily identify its purpose later. This is particularly useful when managing multiple integrations.
5. Copy the API key: Once generated, the API key will be displayed. Copy it immediately, as it will not be displayed again for security reasons. Store this key securely. Further guidance on API key generation is available in the Brevo documentation on creating API keys.

Brevo allows you to generate multiple API keys, which is a good security practice for isolating access for different applications or environments. You can also revoke API keys if they are compromised or no longer needed.

Obtaining SMTP Credentials

1. Log in to your Brevo account: Access your Brevo dashboard.
2. Navigate to SMTP & API: In the left-hand navigation, locate and click on 'SMTP & API'.
3. View SMTP credentials: Under the 'SMTP & API' section, you will find the 'SMTP' tab. Here, your SMTP server details, username (typically your Brevo account email), and password will be displayed.
4. Copy credentials: Copy your SMTP username and password. The password can be regenerated if needed.

It is important to note that the SMTP password is distinct from your Brevo account login password. Brevo's SMTP server host is typically smtp-relay.brevo.com, and the port is usually 587 (TLS/STARTTLS) or 465 (SSL/TLS). Always refer to the Brevo SMTP credentials guide for the most current server details.

Authenticated request example

When making authenticated requests to the Brevo API, you typically include your API key in the api-key header. For SMTP, you provide the username and password during the SMTP connection handshake.

API Key Example (Node.js)

This example demonstrates how to send a transactional email using the Brevo Node.js SDK and an API key. This assumes you have installed the sib-api-v3-sdk package.

const SibApiV3Sdk = require('sib-api-v3-sdk');
const defaultClient = SibApiV3Sdk.ApiClient.instance;

// Configure API key authorization: api-key
let apiKey = defaultClient.authentications['api-key'];
apiKey.apiKey = 'YOUR_BREVO_API_KEY'; // Replace with your actual API key

let apiInstance = new SibApiV3Sdk.TransactionalEmailsApi();

let sendSmtpEmail = new SibApiV3Sdk.SendSmtpEmail();

sendSmtpEmail.sender = { "name": "Sender Name", "email": "[email protected]" };
sendSmtpEmail.to = [{ "email": "[email protected]", "name": "Recipient Name" }];
sendSmtpEmail.subject = "My Test Email";
sendSmtpEmail.htmlContent = "<html><body>This is a test email sent from Brevo!</body></html>";

apiInstance.sendTransacEmail(sendSmtpEmail).then(function(data) {
  console.log('API called successfully. Returned data: ' + JSON.stringify(data));
}, function(error) {
  console.error(error);
});

In this example, YOUR_BREVO_API_KEY must be replaced with an API key generated from your Brevo account. The Brevo transactional email documentation provides further details on sending emails.

SMTP Example (Python)

This Python example uses the smtplib library to send an email via Brevo's SMTP server.

import smtplib
from email.mime.text import MIMEText

# Brevo SMTP details
SMTP_SERVER = 'smtp-relay.brevo.com'
SMTP_PORT = 587  # Use 587 for TLS/STARTTLS
SMTP_USERNAME = '[email protected]' # Your Brevo account email
SMTP_PASSWORD = 'YOUR_BREVO_SMTP_PASSWORD' # Your SMTP password from Brevo

# Email details
FROM_ADDR = '[email protected]'
TO_ADDR = '[email protected]'
SUBJECT = 'SMTP Test Email from Brevo'
BODY = 'This is a test email sent via Brevo SMTP.'

msg = MIMEText(BODY)
msg['Subject'] = SUBJECT
msg['From'] = FROM_ADDR
msg['To'] = TO_ADDR

try:
    with smtplib.SMTP(SMTP_SERVER, SMTP_PORT) as server:
        server.starttls()  # Upgrade connection to secure TLS
        server.login(SMTP_USERNAME, SMTP_PASSWORD)
        server.sendmail(FROM_ADDR, TO_ADDR, msg.as_string())
    print("Email sent successfully!")
except Exception as e:
    print(f"Error sending email: {e}")

Remember to replace [email protected] and YOUR_BREVO_SMTP_PASSWORD with your actual Brevo SMTP credentials. Ensure your firewall allows outbound connections on port 587 or 465. The Brevo SMTP integration guide offers more detailed instructions.

Security best practices

Securing your Brevo authentication credentials is paramount to prevent unauthorized access and maintain the integrity of your marketing and communication efforts. Adhering to the following best practices can significantly enhance the security of your integrations:

• Keep API Keys and SMTP Passwords Confidential: Never hardcode API keys or SMTP passwords directly into your application's source code, especially in client-side applications or publicly accessible repositories. Use environment variables, secret management services, or secure configuration files to store credentials.
• Use Environment Variables: For server-side applications, store credentials in environment variables. This prevents them from being committed to version control systems and makes them easier to manage across different deployment environments.
• Implement Principle of Least Privilege: When generating API keys, assign only the minimum necessary permissions required for the specific task or application. Brevo allows you to define the scope of access for API keys, limiting potential damage if a key is compromised. Regularly review and update these permissions as your application's needs evolve.
• Rotate Credentials Regularly: Periodically rotate your API keys and SMTP passwords. This practice limits the window of opportunity for an attacker to use a compromised credential. Brevo allows you to regenerate keys and passwords from your dashboard.
• Monitor API Usage: Keep an eye on your Brevo API usage and logs for any unusual activity or spikes that might indicate unauthorized access. Brevo provides reporting tools to help monitor your account activity.
• Use HTTPS/TLS for All Communications: Always ensure that all communications with Brevo's API and SMTP servers occur over secure channels (HTTPS for API, TLS/SSL for SMTP). This encrypts data in transit, protecting your credentials and data from interception. Modern SDKs and SMTP libraries typically handle this by default, but it's crucial to confirm. The Internet Engineering Task Force (IETF) provides standards for SMTP security via TLS.
• IP Whitelisting: If supported by your infrastructure and Brevo (check Brevo documentation for specific features), restrict API key usage to a list of approved IP addresses. This adds an extra layer of security by ensuring that requests can only originate from trusted servers.
• Secure Your Development Environment: Ensure that your local development machines and staging environments are secure. Avoid storing production credentials on these environments unless absolutely necessary, and if so, protect them with the same rigor as production credentials.
• Educate Your Team: Ensure all developers and team members who interact with Brevo credentials are aware of these security best practices and understand the importance of secure credential handling.