Authentication

Every API request carries an API key as a bearer token:

Authorization: Bearer YOUR_API_KEY

Keys

Create and revoke keys on the dashboard's API keys page. A key is shown once at creation and never again, so store it in your secret manager right away. You can hold several keys at once (one per environment or server is a sane setup) and revoke any of them without touching the others.

Requests without a valid key get 401. Keys belong to your account: batches, messages, and balance lookups only ever see your own data.

Rate limit

60 requests per minute per account. One request can carry up to 1,000 recipients, so the ceiling is 60,000 messages per minute through the API before you need to talk to us. Requests over the limit get 429 RATE_LIMITED; back off and retry after a minute.

Keep keys server-side

A key can spend your balance. Never ship it in a mobile app, a browser bundle, or a public repo. If a key leaks, revoke it on the dashboard; new sends with it stop immediately.