> ## Documentation Index
> Fetch the complete documentation index at: https://developers.senderz.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate API requests using Bearer tokens with scoped permissions.

## API keys

All requests require an API key in the `Authorization` header:

```
Authorization: Bearer sz_live_xxxxxxxxxxxxxxxxxxxxx
```

## Key types

| Prefix     | Scope                                                                             |
| ---------- | --------------------------------------------------------------------------------- |
| `sz_live_` | Production. Messages are delivered. SID submissions go to the register.           |
| `sz_test_` | Sandbox. Messages are simulated. SID submissions are validated but not submitted. |

## Permissions

Each API key can hold one or more scoped permissions:

| Permission        | Description                                      |
| ----------------- | ------------------------------------------------ |
| `messaging:send`  | Send messages                                    |
| `messaging:read`  | Read message status and history                  |
| `sids:write`      | Create, update, deregister Sender IDs            |
| `sids:read`       | Read SID status and history                      |
| `webhooks:manage` | Create, update, and delete webhook subscriptions |
| `brands:write`    | Onboard and manage brand entities                |
| `brands:read`     | Read brand entity details                        |

A CPaaS customer would typically hold all permissions. A brand customer sending messages under a pre-registered SID might hold only `messaging:send` and `messaging:read`.

## Example

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.senderz.ai/v1/messaging/messages \
    -H "Authorization: Bearer sz_live_xxxxxxxxxxxxxxxxxxxxx"
  ```

  ```python Python theme={null}
  import requests

  headers = {"Authorization": "Bearer sz_live_xxxxxxxxxxxxxxxxxxxxx"}
  response = requests.get(
      "https://api.senderz.ai/v1/messaging/messages",
      headers=headers
  )
  ```

  ```javascript Node.js theme={null}
  const response = await fetch("https://api.senderz.ai/v1/messaging/messages", {
    headers: {
      "Authorization": "Bearer sz_live_xxxxxxxxxxxxxxxxxxxxx"
    }
  });
  ```
</CodeGroup>

<Warning>
  Never expose API keys in client-side code, public repositories, or browser requests. Keys should only be used in server-side environments.
</Warning>