Mailjet Authentication: API Keys & Security Best Practices (2026)

Authentication overview

Mailjet provides an email service for sending transactional emails and managing marketing campaigns, offering a RESTful API for programmatic interaction. Authentication is a critical component for securing access to a Mailjet account and its associated resources, preventing unauthorized users from sending emails or accessing sensitive data. The primary mechanism for authenticating requests to the Mailjet API involves the use of API Key and Secret Key pairs, which function as credentials to verify the identity of the requesting application or user.

When an application sends a request to the Mailjet API, these keys are included in the request to prove the sender's legitimacy. This process ensures that only authorized entities can interact with the email sending infrastructure. Mailjet's authentication system is designed to support various integration patterns, including direct API calls, SDK usage, and SMTP relay, all while maintaining a consistent security posture. Understanding how to manage and secure these credentials is fundamental for any developer integrating with Mailjet's services.

For developers, secure authentication is not only about protecting access but also about maintaining email deliverability and compliance with regulations such as GDPR. Compromised credentials can lead to unauthorized email sending, potential abuse, and damage to sender reputation. Therefore, Mailjet emphasizes the importance of proper credential handling and adherence to security best practices, which are detailed in their API documentation.

Supported authentication methods

Mailjet primarily supports API Key authentication for its REST API and a similar credential-based system for SMTP. These methods are designed for server-to-server communication, where applications need to programmatically send emails or manage email-related resources.

API Key Authentication (REST API)

The Mailjet REST API utilizes a combination of an API Key and a Secret Key for authentication. These two keys act as a username and password pair for API requests. The API Key identifies your account, while the Secret Key authenticates the request, ensuring that only you (or applications authorized by you) can make calls to your Mailjet account. This method is typically implemented using HTTP Basic Authentication or by including the keys as parameters in the request body or headers, depending on the specific endpoint and SDK used.

SMTP Authentication

For applications that send emails via the SMTP protocol, Mailjet provides an SMTP username and password. While functionally similar to the API Key and Secret Key, these credentials are specifically for authenticating with Mailjet's SMTP servers. This allows applications to send emails using standard SMTP libraries and clients, without directly interacting with the REST API. The SMTP username is typically the API Key, and the SMTP password is the Secret Key, though specific configurations might vary slightly as detailed in Mailjet's SMTP relay documentation.

Comparison of Authentication Methods

The following table outlines the primary authentication methods available for Mailjet, their typical use cases, and general security considerations.

Getting your credentials

To obtain your Mailjet API Key and Secret Key, you will need to access your Mailjet account dashboard. These credentials are generated and managed within the platform's settings.

1. Log in to your Mailjet Account: Navigate to the Mailjet dashboard using your registered email and password.
2. Access API Keys Section: Once logged in, go to the 'Account settings' or 'API Key' section. The exact path may vary slightly but typically involves navigating to 'Rest API' or 'API Key Management'.
3. Generate/View Keys: If you haven't generated keys before, you will find an option to create a new API Key and Secret Key pair. If keys already exist, they will be displayed (the Secret Key might be hidden until explicitly revealed for security reasons). Mailjet allows you to create multiple API Key pairs, which can be useful for different applications or environments, enabling better access control and easier key rotation.
4. Copy and Store Securely: Copy both the API Key and Secret Key. It is crucial to store these credentials securely, ideally in environment variables, a secure secrets manager, or a configuration file that is not publicly accessible. Avoid hardcoding credentials directly into your application's source code.

For SMTP credentials, the process is similar; the SMTP username is typically your API Key, and the SMTP password is your Secret Key. Mailjet's API Key management guide provides specific instructions and visual aids for locating and managing these credentials within your account.

Authenticated request example

This example demonstrates how to make an authenticated request to the Mailjet API using cURL with HTTP Basic Authentication, which is a common method for passing the API Key and Secret Key. This example sends a transactional email.

curl -s \ 
  -X POST \ 
  --user "YOUR_API_KEY:YOUR_SECRET_KEY" \ 
  https://api.mailjet.com/v3.1/send \ 
  -H 'Content-Type: application/json' \ 
  -d '{ 
    "Messages":[ 
      { 
        "From":{ 
          "Email":"[email protected]", 
          "Name":"Mailjet Sender" 
        }, 
        "To":[ 
          { 
            "Email":"[email protected]", 
            "Name":"Mailjet Recipient" 
          } 
        ], 
        "Subject":"My first Mailjet email", 
        "TextPart":"Greetings from Mailjet!", 
        "HTMLPart":"<h3>Greetings from Mailjet!</h3><br />May the delivery force be with you!", 
        "CustomID":"AppGettingStartedTest" 
      } 
    ] 
  }'

In this example:

• YOUR_API_KEY should be replaced with your actual Mailjet API Key.
• YOUR_SECRET_KEY should be replaced with your actual Mailjet Secret Key.
• The --user flag tells cURL to use HTTP Basic Authentication with the provided username (API Key) and password (Secret Key).
• The request targets the /v3.1/send endpoint, which is used for sending emails.
• The Content-Type: application/json header specifies the format of the request body.
• The -d flag includes the JSON payload containing the email details.

Mailjet also provides official SDKs for various programming languages (PHP, Python, Ruby, Node.js, Java, Go) that abstract away the HTTP request details, making authentication and API interaction simpler. For instance, in a Python SDK, you would typically initialize the client with your API and Secret keys.

Security best practices

Securing your Mailjet API credentials is crucial for maintaining the integrity and reputation of your email sending operations. Adhering to these best practices will help prevent unauthorized access and potential misuse of your account.

1. Secure Storage of Credentials:
   • Avoid Hardcoding: Never embed your API Key and Secret Key directly into your source code. This practice makes them vulnerable if your code repository is compromised.
   • Use Environment Variables: Store credentials as environment variables on your server or development machine. This keeps them separate from your codebase and allows for easier management across different environments.
   • Secrets Management Services: For production environments, utilize dedicated secrets management services like AWS Secrets Manager, Google Cloud Secret Manager, or Azure Key Vault. These services provide secure storage, access control, and rotation capabilities for sensitive data.
   • Configuration Files (Secured): If using configuration files, ensure they are outside the web root, have strict file permissions, and are excluded from version control systems (e.g., via .gitignore).
2. Principle of Least Privilege:
   • Create separate API Key pairs for different applications or environments.
   • Utilize Mailjet's sub-account features or role-based access control (if available) to limit the permissions of each API Key to only what is necessary for its intended function. For example, an API Key used only for sending transactional emails should not have permissions to manage contacts or view billing information.
3. Key Rotation:
   • Regularly rotate your API Key and Secret Key pairs. This practice limits the window of opportunity for an attacker if a key is compromised. The frequency of rotation depends on your organization's security policy, but quarterly or bi-annual rotation is a common recommendation.
   • Mailjet's dashboard allows you to generate new keys and revoke old ones.
4. Monitor API Usage:
   • Regularly review your Mailjet account's activity logs and usage statistics for any unusual patterns or suspicious activity. Unexpected spikes in email sending or API calls could indicate a compromised key.
   • Set up alerts for abnormal usage if Mailjet's platform offers such features.
5. Secure Transmission:
   • Always ensure that all communication with the Mailjet API occurs over HTTPS (TLS). Mailjet enforces this by default for its REST API, encrypting data in transit. This prevents eavesdropping and tampering with your credentials or email content. The IETF's TLS 1.3 specification provides strong encryption standards.
6. IP Whitelisting (if available):
   • If Mailjet offers IP whitelisting for API access, configure it to restrict API calls only from known, trusted IP addresses of your servers or applications. This adds an additional layer of security, making it harder for unauthorized parties to use your keys even if they are compromised.
7. Error Handling and Logging:
   • Implement robust error handling in your application to catch authentication failures.
   • Log authentication attempts (especially failures) to identify potential brute-force attacks or unauthorized access attempts. Be careful not to log the credentials themselves.

By implementing these security best practices, developers can significantly reduce the risk of unauthorized access to their Mailjet accounts and ensure the secure and reliable operation of their email services.