API keys

Programmatic access uses API keys — never expose them in frontend code.

Create a key

• Dashboard → API Keys → Create
• Copy the full key once — it is shown only at creation
• Store in a secrets manager (not git)

Permissions

Keys can be scoped to SMS send, balance read, etc. Deactivate compromised keys immediately and rotate.

Signing

Message endpoints require HMAC signatures. Balance checks use X-API-Key only.