Authentication
Sign in to Inboxwire with magic links, passkeys and two factor, and call the API with keys.
Magic link
Enter your email on the sign in page and we send a one time link. The link expires after a short time and works once. Open it on the same device where you asked for it for the smoothest experience.
Passkeys
Add a passkey in Settings, then Security. After that you can sign in with your fingerprint, face or device PIN. Passkeys are bound to this site, so they cannot be phished. We recommend adding at least two.
Two factor authentication
Turn on two factor in Settings, then Security. Scan the QR code with an authenticator app and enter the six digit code to confirm. Save your recovery codes somewhere safe. Each works once if you lose your device.
API keys
Server to server requests use API keys. Create and revoke them in Settings, then API keys. Send the key in the x-api-key header on every request. Never put a key in browser code or a public repository. If a key leaks, revoke it and create a new one.
Each key has a scope (read, send or admin) and, by default, one environment. A key bound to production answers 403 environment_not_allowed if it sends x-environment: development. Keys created with "Any environment" pick the environment per request with the x-environment header (production when it is missing).
curl https://inboxwire.buffersoltech.com/api/v1/me \
-H "x-api-key: YOUR_API_KEY"