Authentication

Every request to the public API carries your API key as a bearer token.

Required on every request

Authorization: Bearer YOUR_API_KEY

There's no separate API version header or query parameter — the version lives in the URL (/api/v1/…).

Key format

A key is a 64-character hex string with no prefix, generated server-side and shown to you exactly once. See API Keys for how it's created, stored, and revoked.

What a key can do

A key authenticates as its owner's account, with exactly that account's permissions — it can send from SIMs the account owns or has been explicitly granted access to, and read only that account's messages and stats. There's no elevated or admin-scoped key type.

When authentication fails

Situation	Response
No `Authorization` header at all	`401` — treated as an anonymous, unauthenticated request
Header present but not a revoked/unknown/malformed key	`401 auth_invalid_key`

JSON

// 401
{ "error": "Invalid or inactive API key.", "code": "auth_invalid_key" }

Not the same as your dashboard login

The dashboard itself uses ordinary session cookies when you're logged in through a browser — nothing you'd call from code, and not interchangeable with an API key.