Authentication
Create a customer key and connect your backend securely.
Create and store your key
Open API access from your signed-in dashboard, name the integration and create a key. The full secret is shown once. Store it in a secret manager or server environment variable.
Keys created through the dashboard remain valid until revoked. You can create separate keys for separate integrations; there is no limit on the number of keys. Rate limits are shared by the customer, not multiplied by key count.
Keep credentials private
Never place a key in browser JavaScript, mobile app bundles, URL query strings, screenshots or source control. Make API calls from your backend.
If a key is exposed, revoke it in API access and update your integration with a newly created key. Do not include keys in support tickets or application logs.
Understand account access
Your API keys can read SMS catalogue data, manage your own SMS orders and read the shared wallet balance. You cannot access another customer's orders.
Wallet top-ups and API-key management take place in the signed-in dashboard. A 401 response means the key is missing, invalid, revoked or expired. Check the header and the key status before retrying.