1
Generate a key
Open Integrations → API Keys and choose Generate API Key. Give it a name identifying the application and environment, select the required scopes, and optionally set an expiration.
2
Store the secret
Copy the value when it is displayed and put it in your application’s secret store or server environment. Key details show metadata, not a recoverable copy of the original secret.
3
Verify read access
With a key that has
templates:read, request GET /v1/templates using the API URL for the same environment. See Send with the API.Scope and role matrix
Each row adds to the permissions above it. Having a role does not automatically add every permitted scope to a key.
Compile and send both require
messages:create. Reading templates does not permit sending. A typical sender uses templates:read to discover templates and inputs, plus messages:create to deliver. Grant templates:activate separately when an application should be allowed to select the version used by future sends.
Rotate and revoke
For a planned rotation, generate a replacement key, update the application, verify a request, and revoke the old key from its action menu. Recycle Key replaces an existing credential; coordinate the application update before using it. Revocation and scope changes can take up to 15 minutes to reach cached API authentication. If a credential is exposed, revoke it, remove it from the exposed location, and contact support if you need help containing ongoing access.Troubleshoot
Use the machine-readable
code and request_id when reporting failures. Never include the key in a support message. See Organization access.