---
title: "List a mailbox's app passwords"
method: GET
path: "/api/mailboxes/{id}/app-passwords"
tags: ["Mailboxes"]
---

# List a mailbox's app passwords

`GET /api/mailboxes/{id}/app-passwords`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/mailboxes/{id}/app-passwords`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `mailboxes:read`)

Every app password on the mailbox — name, protocols, last four characters and last use. The secrets themselves are stored hashed and are not retrievable here or anywhere else; a password you have lost is replaced, not recovered.

Requires the `mailboxes:read` scope — View the mailboxes on your domains and their settings.

## Path parameters

- `id` string, uuid, required

## Response `200`

App password list

- object
  - `data` AppPassword[], required
    - `createdAt` string, date-time, required
    - `id` string, uuid, required
    - `lastFour` string, required: The last four characters of the secret — enough to tell two credentials apart, and nothing more.
    - `lastUsedAt` string, date-time, nullable, required: Null until a mail client has authenticated with it at least once.
    - `name` string, required: What the credential is for, e.g. `Thunderbird on my laptop`.
    - `scopes` string[], required: Which protocols this password may authenticate. `imap` reads, `smtp` sends.
  - `success` true, required

## Other responses

- `400`: Validation error
- `401`: Unauthorized — missing or invalid auth
- `403`: Forbidden — insufficient permissions or project disabled
- `404`: Resource not found
- `429`: Rate limit or billing limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)