Authentication

sending.ac has two APIs and two kinds of key. They are not interchangeable, and using the wrong one is the most common first failure — it returns 403, not 401, because the key itself is valid.

The two key types

	Mailbox API	Provisioning API
Prefix	sk_live_…	sac_live_… / sac_test_…
Scope	mailbox	scoped per operation
Environments	live only	live and sandbox
Issued from	Production Credentials in the customer portal	the sending.ac partner dashboard
Base URL	https://api.customers.ac/api/mailbox/v1alpha1	https://live-api.customers.ac/v1

Both are sent the same way:

Authorization: Bearer <your key>

Mailbox API keys

Mailbox APIv1alpha1Unstable

Base URL

https://api.customers.ac/api/mailbox/v1alpha1

Key

sk_live_…Scope mailbox, live only. Sandbox keys are refused.

A Mailbox key must be scope mailbox and environment live. Both are enforced:

• a Provisioning key returns 403 / ErrorAccessDenied
• a sandbox key returns 403 / ErrorAccessDenied

Sandbox keys are refused by design rather than downgraded to a mock. Every call touches a real Microsoft 365 mailbox, and sendMail delivers real mail to real recipients, so there is nothing sandbox-like to offer.

Errors on this API use Microsoft’s OData error shape, not a sending.ac envelope, so a Graph SDK deserialises them as ordinary GraphErrors.

Provisioning API keys

Provisioning APIv1Internal testing

Base URL

https://live-api.customers.ac/v1

Key

sac_live_… / sac_test_…Scoped per operation. Sandbox provisions nothing.

Provisioning tokens are scoped per operation. A request that needs a scope your token does not carry returns 403 auth.insufficient_scope.

Live keys begin with sac_live_, sandbox keys with sac_test_. Unlike the Mailbox API, sandbox is meaningful here: no real infrastructure is provisioned and operations complete instantly, which makes it useful for exercising the async flow without waiting on M365.

Internal testing — not generally available

The Provisioning API is still in internal testing. Endpoints and payloads may change without notice, and access is granted case by case. Treat the reference as a preview rather than a contract, and talk to us before building against it.

Rate limits

API	Limit	On exceeding
Mailbox	60 requests/minute per key	429 with Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset
Provisioning	120 requests/minute per token	429 rate.quota_exceeded with Retry-After

Which one do I want?

• Sending or reading mail from a mailbox that already exists → Mailbox API.
• Creating users, senders, domains or mailboxes on behalf of your own customers → Provisioning API.

Most integrations that do both hold one of each.