Providers / Postmark
Postmark API keys and credentials
What every Postmark credential a founder holds does, whether it expires, and what tends to break. Each fact links to Postmark's own docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Postmark account login | Not documented | – |
| Server API token | Not documented | Can be scoped |
| Account API token | Not documented | Not documented |
Each credential
Postmark account login
- Not documented
Dashboard login. Password/2FA policy not confirmed in sources.
Server API token
- Not documented
- Can be scoped
Sent in the X-Postmark-Server-Token header. Used for server-level requests (sending, messages, templates, stats for one server). Scoped to one server. Accessible to Account Owners, Account Admins and Server Admins. No expiry or rotation is stated in the API overview. Revoke from the server's API Tokens tab, then generate a replacement.
Account API token
- Not documented
Sent in the X-Postmark-Account-Token header. Used for account-level requests such as creating servers, sender signatures and domains. Accessible only to Account Owners and Account Admins. No expiry or rotation is stated.
What usually goes wrong
- Requests with a missing or wrong token header return HTTP 401
- Using the account token where a server token is expected (or the reverse) causes 401 errors
- Free plan sending stops at 100 emails per month because overages are not allowed
Renewals and billing
- Postmark plan (Basic, Pro or Platform), billed monthly. Monthly only; annual plans not offered. Basic $15/mo, Pro $16.50/mo, Platform $18/mo, each starting at 10,000 emails with overage charges. Free plan is 100 emails/month with no overages.
Subscription with per-1,000 overage (Basic $1.80, Pro $1.30, Platform $1.20). Overages are billed at the end of each billing cycle and added to the next month's bill. Unused emails do not roll over.
What Postmark's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Whether server or account tokens ever expire or can be rotated on a schedule
- Exact server-token scope boundaries beyond the documented access levels
- Whether there is an API endpoint to list tokens or their creation dates
Rotating or replacing a Postmark key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
Related providers
Keep track of every Postmark key
StackHangar stores your Postmark keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.