Nylas, the communications data layer powering core product experiences and agentic AI workflows, today announced the general availability of Nylas IAM, a scoped API key system for email and calendar data. The launch gives developers a way to issue a unique key for each service that calls Nylas, with permissions and boundaries enforced on every request.
Quick Intel
-
Nylas announced the general availability of Nylas IAM, a scoped API key system for email and calendar data.
-
Each service or AI agent gets a unique API key scoped to the actions and accounts it needs.
-
Every request is verified against the key's scope before it reaches the email or calendar provider.
-
Each key is built from a principal with permissions, a boundary and Access Activity logging.
-
Keys can be limited to a single mailbox or calendar, or extended across a workspace, application or organization.
-
IAM is included on every Nylas plan at no additional cost, and existing API keys continue to work.
With IAM, developers can issue a unique API key for each service that calls Nylas, scoped to the actions that service needs and to the account, workspace, application or organization it works in. Nylas verifies every request against the key's scope before it reaches the email or calendar provider, and records every call, including the ones it refuses. IAM is included on every Nylas plan at no additional cost.
Why Scoped Access Matters for Email and Calendar Data
Teams building on email and calendar data once connected a single service to Nylas. Today they often run several, and increasingly an AI agent alongside them. Security teams are paying attention: 81% of security leaders say they are concerned about excessive AI access, according to Okta's Global CISO Insights 2026 survey of 306 security leaders across six countries.
How Nylas IAM Keys Are Structured
Each IAM key comes from a principal, which holds three things:
Permissions that define what the key can do, such as reading messages without sending them. Teams can start from built-in roles or define their own.
A boundary that defines where the key can act: one connected account, one workspace, one application, or an entire organization.
Access Activity, a record of every call the key made, the account it touched, and whether Nylas allowed or refused it.
Controlling What AI Agents Can Reach
For teams building AI agents, IAM settles in advance what an agent can reach. An agent whose key holds only read access can read a customer's thread and prepare a suggested reply for a person to approve, but if it tries to send, the call is refused and logged. The Nylas MCP server also filters the tools it exposes based on the permissions of the key it uses.
IAM works alongside the identity platforms enterprises already use to manage which applications and agents hold access. Because Nylas checks each request before it reaches the provider, a key can be limited to an individual mailbox or calendar and to specific actions within it.
Leadership Perspective
"Teams used to connect one service to Nylas. Now they run several, and many are adding an agent next to them," said Hazik Afzal, VP of Product at Nylas. "IAM lets them decide what each one can reach once, in one place, and we enforce it on every request. When a security reviewer asks what a service can access, the answer fits on one line."
About Nylas
Nylas is the communications data layer powering core product experiences and agentic AI workflows. Through a single integration, Nylas normalizes email, calendar, and contacts across Gmail, Microsoft, IMAP, and 250+ other providers, giving product teams reliable access to communications infrastructure without managing provider complexity.
