Authentication

Every request carries your key in the x-api-key header. Keep it on your server: never embed it in a mobile app or a web page.

x-api-key: VOTRE_CLE

Test and production keys

Prefix	Use	Sends real SMS
sk_test_	Development, continuous integration	No, everything is simulated
uk_	Production, after account approval	Yes, debits your credits

The test key only gives access to the message endpoints, and only to sandbox messages. It cannot manage the account or read your real messages.

Regenerate a key

Key	Request
Production	DELETE /v1/users/{id}/api-keys
Test	DELETE /v1/users/{id}/test-api-keys

The old key stops working immediately. A request without a valid key gets 401 Unauthorized.

Dashboard sign-in

The google mode signs people in directly with Google OAuth/OpenID Connect. GetSMS accounts and sessions are stored in PostgreSQL. Firebase Cloud Messaging remains separate for relay notifications; Firebase Authentication is not required.

The browser routes GET /v1/auth/google, GET /v1/auth/google/callback, GET /v1/auth/session and POST /v1/auth/logout use an HttpOnly session. They do not replace SMS integration API keys and are not exposed through MCP. Session-authenticated mutations require the dashboard’s exact allowed origin.