API Keys

Programmatic management of your API keys.

List API Keys

GET /v1/api-keys

Returns all API keys for the authenticated user account.

cURL

curl https://sendapi.co/v1/api-keys \
  -H "Authorization: Bearer sk_live_123456789"

Node.js

const keys = await client.account.keys.list();

Response

{
  "data": [
    {
      "id": 20,
      "name": "Production",
      "key_prefix": "sk_live_yCLJ",
      "scopes": ["whatsapp:write", "sms:write", "email:write"],
      "permissions": [],
      "last_used_at": "2026-03-09T14:30:00.000000Z",
      "expires_at": null,
      "is_active": true,
      "created_at": "2026-03-01T00:00:00.000000Z"
    }
  ]
}

The key_prefix is the first 12 characters of the key — useful for identifying which key is which without exposing the secret.

---

Create an API Key

POST /v1/api-keys

Creates a new API key. The full secret value is returned only once — store it immediately.

Request Body

Parameter	Type	Required	Description
name	string	Yes	A human-readable label (e.g., "Production").
scopes	array	No	Restrict the key to specific channels (see below). Omit for full access.
permissions	array	No	Fine-grained permission strings. Omit for full access.
expires_at	string	No	ISO 8601 timestamp at which the key auto-expires. Omit for no expiry.

cURL

curl -X POST https://sendapi.co/v1/api-keys \
  -H "Authorization: Bearer sk_live_123456789" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production",
    "scopes": ["sms:write", "email:write"]
  }'

Node.js

const newKey = await client.account.keys.create({
  name: 'Production',
  scopes: ['sms:write', 'email:write']
});

console.log(newKey.key); // sk_live_... (save this — only shown once!)

Response

{
  "data": {
    "id": 21,
    "name": "Production",
    "key": "sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "key_prefix": "sk_live_yCLJ",
    "scopes": ["sms:write", "email:write"],
    "permissions": [],
    "expires_at": null,
    "created_at": "2026-03-09T14:30:00.000000Z"
  }
}

Store the secret immediately

The key field is returned only on creation. List and get endpoints only return the key_prefix. If you lose the full key, revoke it and create a new one.

---

Revoke a Key

DELETE /v1/api-keys/{id}

Deletes the API key. Subsequent requests using that key return 401 Unauthorized.

curl -X DELETE https://sendapi.co/v1/api-keys/21 \
  -H "Authorization: Bearer sk_live_123456789"

---

Key Scopes

API keys can be scoped to restrict access to specific channels:

Scope	Permissions
whatsapp:read	Read sessions, messages, contacts
whatsapp:write	Create sessions, send messages
sms:write	Send SMS messages
email:write	Send emails
verify:write	Send OTPs and verify codes
account:read	Read usage and billing info

A key with no scopes has full access. A key with scopes can only access endpoints in those channels.

---

Per-plan Limits

Plan	Max API Keys
Starter	1
Growth	3
Business	10
Enterprise	Unlimited