AttuneMail
Menu
Start trial
AttuneMail DocsTroubleshooting
API

API authentication

Authenticate Segment-compatible calls and native webhooks without exposing connection credentials.

Updated 2026-08-236 min

Accepted server authentication

MethodFormatBest use
HTTP BasicWrite key as username, empty passwordSegment-compatible server clients
BearerAuthorization: Bearer <write-key>Plain server HTTP integrations
X-Write-KeyX-Write-Key: <write-key>Compatible server gateways
X-AttuneMail-Webhook-SecretHeader value is the connection secretExisting AttuneMail canonical integrations
Native webhook URLSecret embedded in the one-time URLStripe, Clerk, and Supabase

Store and rotate safely

  1. 01

    Copy once

    Store the revealed credential in your existing server-side secret manager.

  2. 02

    Scope by source and environment

    Use separate credentials for each producer and deployment environment.

  3. 03

    Rotate on exposure

    Generate a new connection credential, update the producer, verify traffic, then retire the exposed value.

Authentication examples

POST /v1/track
Copy
cURLNode.jsPython
curl -u 'ame_replace_me:' -H 'Content-Type: application/json' -d '{"messageId":"evt_123","userId":"cus_123","event":"trial.started"}' https://www.attunemail.com/v1/track

Never expose a write key

  • ✓Do not embed it in a web page, browser bundle, mobile binary, or tag manager
  • ✓Do not paste it into tickets, chat, logs, screenshots, or analytics
  • ✓Do not reuse it across customers or environments
  • ✓Do not place native webhook URLs in source control