Authentication - Senderz API

API keys

All requests require an API key in the Authorization header:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxx

Key types

Prefix	Scope
`sk_live_`	Production. SID submissions go to the register. Operator approvals are binding. Messages are delivered.
`sk_test_`	Sandbox. SID submissions are validated but not submitted. Operator actions are simulated. Messages are not dispatched.

Permissions

Each API key can hold one or more scoped permissions:

Permission	Description
`sids:write`	Create, update, deregister Sender IDs
`sids:read`	Read SID status and history
`brands:write`	Onboard and manage brand entities
`brands:read`	Read brand entity details
`operator:write`	Approve or reject registrations
`operator:read`	List registrations and view analytics
`messaging:send`	Send messages
`messaging:read`	Read message status and history
`webhooks:manage`	Create, update, and delete webhook subscriptions

A CPaaS customer would typically hold sids:*, brands:*, messaging:*, and webhooks:manage. An MNO would hold operator:* and webhooks:manage. A brand customer using Senderz only for SID registration might hold sids:read, brands:write, and brands:read.

Example

curl https://api.senderz.ai/v1/sids \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxx"

import requests

headers = {"Authorization": "Bearer sk_live_xxxxxxxxxxxxxxxxxxxxx"}
response = requests.get(
    "https://api.senderz.ai/v1/sids",
    headers=headers
)

const response = await fetch("https://api.senderz.ai/v1/sids", {
  headers: {
    "Authorization": "Bearer sk_live_xxxxxxxxxxxxxxxxxxxxx"
  }
});

Never expose API keys in client-side code, public repositories, or browser requests. Keys should only be used in server-side environments.