# Manage Domains API now uses IAM API keys

Source: https://developer.nylas.com/docs/changelogs/2026-11-09-manage-domains-iam-api-keys/

The [Manage Domains API](/docs/v3/email/domains/) now uses `/v3/domains` and authenticates with an [IAM API key](/docs/v3/auth/nylas-iam/). You no longer need a Nylas Service Account to register and verify the domains you use with [Transactional Send](/docs/v3/getting-started/transactional-send/) and [Agent Accounts](/docs/v3/agent-accounts/).

## Changed

- **New endpoint path.** The Manage Domains endpoints moved from `/v3/admin/domains` to `/v3/domains`. For example, [register a domain](/docs/reference/api/manage-domains/create-domain/) with `POST /v3/domains`, and [verify it](/docs/reference/api/manage-domains/verify-domain/) with `POST /v3/domains/{domain_id}/verify`.
- **IAM API key authentication.** Send an IAM API key as a bearer token. Its principal needs an Organization binding and the 4 Domains permissions: `domains.read`, `domains.create`, `domains.update`, and `domains.delete`. You no longer sign requests with Service Account headers. See [Create an IAM API key for domains](/docs/v3/email/domains/#create-an-iam-api-key-for-domains).

## Documentation

- **Domains guide.** [Manage email domains with the Domains API](/docs/v3/email/domains/) now walks through creating the IAM API key in the Dashboard, with screenshots. It also shows the full register-and-verify flow as a diagram, plus the DNS records to add and common errors.
- **IAM permissions reference.** The new [Nylas IAM permissions reference](/docs/v3/auth/nylas-iam/permissions/) lists every direct permission and the resource binding each one needs.
- **API reference.** The [Manage Domains API reference](/docs/reference/api/manage-domains/) uses the new paths and IAM API key auth. It also documents the `dmarc` and `arc` verification types, the 2048-bit DKIM key option, and looking up a domain by its address instead of its ID.