Authentication
Authenticate every request with a secret API key.
Send your API key as a bearer token in the Authorization header of every request:
curl https://api.appstractone.com/v1/balance \
-H "Authorization: Bearer sk_live_..."Requests without a valid key get 401:
{
"error": {
"code": "invalid_api_key",
"message": "Invalid API key",
"request_id": "req_65ca5e2c-86b1-4d19-bb97-766df8edf05a"
}
}Live and test keys
| Prefix | What it does |
|---|---|
sk_live_ | Sends real messages and charges your wallet. |
sk_test_ | Simulates everything. Nothing is sent or charged. See Test mode. |
Keeping keys safe
- Keep keys on your server. Never ship them in a browser, mobile app or public repository.
- Use a separate key for each system, so you can rotate one without affecting the others.
- Rotate a key from your dashboard if you think it has leaked. The old key stops working immediately.
IP allowlists
You can limit a key to a list of IP addresses. Requests from any other address get 403 with the code ip_not_allowed.
Suspended accounts
If your account is suspended, every request gets 403 with the code account_suspended. Contact support to resolve it.