Authentication▾

Authentication

Sendport uses bearer API keys. Test keys reach the sandbox, live keys reach WhatsApp.

Every request carries an API key in the Authorization header. There are no other auth schemes — no query-string keys, no HTTP basic, no OAuth for server-to-server calls.

curl https://api.sendport.tech/v1/numbers \
  -H "Authorization: Bearer sp_live_9f2c…"

Environments

PrefixReachesBilledNotes
sp_test_SandboxNoCanned responses, no WhatsApp traffic, no rate limiting
sp_live_WhatsApp Cloud APIYesMeta conversation pricing applies

Keys are secrets

A key grants full access to every number on the account. Keep it server-side, never in a browser bundle or mobile app, and rotate immediately if it leaks.

Rotating a key

  1. 1.Create a second key in the dashboard.
  2. 2.Deploy it. Both keys are valid at the same time.
  3. 3.Confirm traffic has moved — the key list shows a last used timestamp.
  4. 4.Revoke the old key. Revocation takes effect within a few seconds.

Failed authentication

401 Unauthorized
{
  "error": {
    "type": "authentication_error",
    "code": "missing_api_key",
    "message": "No API key provided. Send it as an Authorization header: `Authorization: Bearer sp_test_…`.",
    "doc_url": "https://sendport.tech/docs/errors#missing_api_key",
    "request_id": "req_9f3c2a7b41de08c5b2e6"
  }
}
PreviousQuickstartNextSandbox