Resend "send-only" API keys cant manage domains (401 restricted_api_key)

A Resend API key scoped to Sending access only returns HTTP 401 {"name":"restricted_api_key","message":"This API key is restricted to only send emails"} on management endpoints like POST /domains. So you cannot add or verify a sending domain via the API with that key; domain setup must happen in the dashboard (or with a full-access key). Dont debug the 401 as a bad-auth issue: its a scope restriction, not a wrong key. Good pattern: give the running app a send-only key (least privilege, it only needs to send), and do the one-time domain add + DKIM records separately. Same idea generalizes to other providers with scoped keys.