Channel keys▾
Channel keys
Scope an API key to a single channel so one integration cannot send from every number you own.
An account key can send from any channel. A channel key is restricted to one — useful when a number belongs to a specific brand, region or vendor, and you do not want a leak to reach the rest.
- 1
Create the key
Dashboard → API keys → Create key → scope it to a channel, or do it over the API.
cURLcurl -X POST https://api.sendport.tech/v1/keys \ -H "Authorization: Bearer $SENDPORT_KEY" \ -H "Content-Type: application/json" \ -d '{ "label": "Cairo storefront", "scope": { "channel": "pn_01JZQ2E5R7T9V1X3Z5B7D9FHKM" } }' - 2
Store the secret
The full key is returned once, at creation. After that only the last four characters are shown.
201 Created{ "object": "api_key", "id": "key_01JZQ7B2M4N8P0R2T4V6X8ZACE", "label": "Cairo storefront", "prefix": "sp_live_", "key": "sp_live_9f2c7b1a4d8e0c3f6a5b2d1e", "scope": { "channel": "pn_01JZQ2E5R7T9V1X3Z5B7D9FHKM" }, "created_at": "2026-09-06T09:14:22.114Z" } - 3
Use it
Every endpoint behaves the same.
fromis implied by the key's scope, and passing a different channel returns403.
Scopes
| Scope | Can send from | Can read |
|---|---|---|
| Account (default) | Every channel | Every conversation on the account |
| Channel | One channel | Only conversations on that channel |
Scoping is not sandboxing
A channel key still sends real, billable messages on that number. It limits blast radius; it does not make a key safe to hand out. For anything untrusted, issue a
sp_test_ key — see Sandbox.Rotating
- 1.Create a replacement key with the same scope.
- 2.Deploy it. Both keys work at once.
- 3.Watch the last used timestamp on the old key until it stops moving.
- 4.Revoke it. Revocation applies within a few seconds.