Account, project, environment
An account is what somebody signs up for and what gets billed. A project sits inside it, and a project has exactly two environments: live and test. An environment is what a key belongs to and what every operation acts on — contacts, templates, domains, users and messages are all per environment, and nothing crosses between them.
Live and test are the two rungs. A test key reaches the same operations against separate data, and what it can send is deliberately limited; see the test mode guide.
Keys
A secret key carries named permissions and belongs on a server. A publishable key holds one built-in permission, auth:public, and is safe in a browser because it reaches only the end-user sign-in operations.
A permission is a product and a verb, like email:write. The prefix is the first 18 characters of a key, which is what a lookup matches before the rest is hashed and compared — it is what a list of keys shows you, because the key itself is shown exactly once.
A user is one of your customers, signing in to your product. A member is one of your own team in the Lath dashboard. The two are different tables and never mix.
An identity is one proved way a user signs in — an address and the provider that proved it. A user can hold several, which is how one person signs in with an email address and a Google account and stays one user.
A contact is an audience record: somebody you send marketing to. A user and a contact can be the same human and are still separate things, because consent belongs to the contact and sign-in belongs to the user.
Sign-in words
A challenge is one sign-in attempt in progress: auth.signin.start creates one and returns its id, and the code or link you received is its secret.
A session family is a sign-in and every refresh token it has rotated into. Revoking a session ends the family, and presenting a spent refresh token revokes the family — that is why the word exists.
A handoff code is the one-time lath_code a hosted sign-in puts in its redirect, exchanged for real tokens. A second factor is the extra step after the password or code; an mfaToken is what verify returns in place of a session when one is owed.
Sending words
A template has a draft and a published version, and only the published one sends. A variant is one language’s version of a template, drafted and published on its own.
A broadcast is one message to an audience, sent once. An automation is a message that sends itself when an event happens.
A suppression is an address Lath will not send to, and consent is the record of what somebody agreed to receive. A topic is the thing consent is about, so unsubscribing from one is not unsubscribing from everything.
A segment is two different words depending on the product: an audience filter for broadcasts, and a unit of SMS billing.
Domain and delivery words
A sending domain is a domain you have proved you own, through DNS records. Its return path is the subdomain bounces come back to, which is what the receiving server checks SPF against rather than your From address.
A blocker is the single sentence an operation gives for why something cannot happen yet — a domain that is not verified, a carrier registration that is not active. It is a field, not a status, because the status says what state a thing is in and the blocker says what to do about it.
Developer words
An operation is one thing the API does, named product.thing.verb, and it is the same unit on every surface: a REST path, an SDK method, a CLI command and an MCP tool are four spellings of one operation.
An event is something that happened, which webhooks deliver. Activity is the audit trail of operations that were called, attributed to the person or key that called them. An endpoint is a URL you registered to receive events, and a delivery is one attempt to reach it.
An idempotency key makes a repeated call return the first call’s answer instead of doing the thing twice.Last modified on September 16, 2026
