Wrap your Postmark server tokens in proxy tokens with IP restrictions and instant revocation.
See how ShieldKey protects your Postmark integration with minimal code changes.
import { ServerClient } from "postmark";
const client = new ServerClient(
"abc123-def456..." // ← server token shared
);
await client.sendEmail({
From: "noreply@app.com",
To: "user@example.com",
Subject: "Welcome",
TextBody: "Hello!"
});import { ServerClient } from "postmark";
const client = new ServerClient(
"sk_shield_t_8e3a..." // ← revocable proxy token
);
// Routes through proxy.shieldkey.io
await client.sendEmail({
From: "noreply@app.com",
To: "user@example.com",
Subject: "Welcome",
TextBody: "Hello!"
});Disable any team member's access to your Postmark key in one click. No key rotation. No downtime. No re-deploying environment variables.
Set per-token spend caps so a compromised token can't run up your Postmark bill. Get alerts before limits are hit.
Restrict each shield token to specific IPs or CIDR ranges. Even if a token leaks, it's useless from unauthorized networks.
See every API call made through your Postmark key — who made it, when, from where, and what they accessed.
Your Postmark key is encrypted with AES-256-GCM. It's only decrypted in memory during request proxying — never stored in plaintext.
Issue individual shield tokens to each team member. When someone leaves, revoke their token — everyone else keeps working.
Add your Postmark key to ShieldKey's encrypted vault. ShieldKey generates a proxy token (starting with sk_shield_t_) that your team uses instead. Your real pm- key stays encrypted and is never exposed to team members.
Yes. Point your postmark SDK at proxy.shieldkey.io and use a shield token instead of your real API key. The SDK works identically — ShieldKey transparently proxies every request.
Revoke their shield token from the dashboard. Your real Postmark key stays active — no rotation, no downtime, no re-deploying secrets across services. Everyone else keeps working without interruption.
ShieldKey's proxy adds less than 25ms at the p50. The proxy decrypts your key in memory, forwards the request, and streams the response back. For most Postmark API calls, this overhead is negligible.
Set up ShieldKey in under 5 minutes. No credit card required.
Start Free