Editor API

The Editor API page manages backend API credentials, editor launch settings, Return URL, Push URL, and Push Key settings for one Application.

It contains three tabs:

• Application Keys
• Embed
• Push URL

The UI tab is named Application Keys, but the values created there are API credentials used by your backend.

Application Keys

The Application Keys tab stores API credentials for this Application.

Use these credentials only from your backend when calling Editor plugin APIs:

https://api.aurorasendcloud.com/editor-plugin/

Do not expose API credentials in frontend code, mobile apps, logs, or public repositories.

Create API credentials

1. Open your Application.
2. Go to Editor API.
3. Open the Application Keys tab.
4. Copy the generated Client ID and Client Secret.
5. Store both values securely on your backend.

Manage API credentials

Use the API Keys table to:

• View existing credential names.
• Copy values that are still available.
• Rename credentials.
• Rotate the Client Secret after email verification.
• Delete credentials that should no longer be used.

Deleting a credential prevents it from creating new Application access tokens. Access tokens already issued from that credential remain valid until they expire or are otherwise revoked.

When the Client Secret is rotated, the previous Secret remains accepted for 30 minutes to allow a controlled rollout. Secret rotation has a 30-minute cooldown and does not invalidate access tokens that were already issued.

Embed

The Embed tab manages launch-related settings for opening the editor from your product.

Supported launch methods:

Both methods require your backend to prepare an editor URL with:

• A temporary code.
• A public email slug ID.
• Optional language settings.

Use Launch Methods for iframe, link, and JavaScript examples.

Return URL

The Return URL controls where users go after leaving the editor in a new-window or link-based flow.

Example:

https://app.yourproduct.com/templates

The Return URL is not used to deliver saved email content. Saved content is delivered through the Push URL callback.

Push URL

The Push URL tab configures where the Editor plugin sends saved email content after an End User saves in the editor.

Example:

https://api.yourproduct.com/webhooks/editor-save

Your endpoint should:

• Use HTTPS.
• Be reachable from Editor plugin servers.
• Accept POST requests.
• Process duplicate callbacks safely.
• Store saved content before returning HTTP 200.

Push Key

The Push Key is used by your backend to process encrypted callback requests.

When you reset the Push Key, copy and store the complete returned value immediately. Later configuration queries show only a masked value. Keep the Push Key on your backend only; resetting it immediately invalidates the previous key.

Use Push URL Callback for callback request format, encrypted delivery flow, payload handling, and testing guidance.

Security notes

• Store API credentials on your backend.
• Do not expose API credentials or the Application access token to frontend code.
• Pass only temporary codes to the browser.
• Generate a new temporary code every time the editor opens.
• Rotate or delete credentials if they may have been exposed.
• Use different credentials for production and staging environments.