Authentication and API keys
Create an API key, send it as a Bearer token and keep it secret.
Every API call needs an API key.
Live and test keys
| Key starts with | What happens |
|---|---|
yanu_live_ | Real SMS. Each message is charged to your balance. |
yanu_test_ | Sandbox. Nothing is sent to a phone and nothing is charged. Use it while you build. |
A test key only sees test messages. A live key only sees live messages.
Create a key
- Sign in at app.smsyanu.com.
- Open API keys and choose Create key.
- Give it a name, for example
website, and pick live or test. - Copy the key now. It is shown once. We only store a fingerprint of it.
Send the key
Put the key in the Authorization header on every request:
Authorization: Bearer yanu_live_YOUR_KEYDo not put the key in the URL. URLs end up in logs.
Scopes
A key can be limited to some actions.
| Scope | Allows |
|---|---|
send | Sending messages. |
query | Reading messages and balance. |
webhooks | Reading and changing webhook settings. |
New keys get send, query and webhooks. A call outside the key's scopes gets HTTP 403 with code insufficient_scope.
Keep keys safe
- Keep keys on your server. Never put a key in a mobile app, a web page or a public code repository.
- Use one key per app, so you can turn one off without stopping the others.
- If a key leaks, delete it in the dashboard at once and create a new one.
To be confirmed
Scope names come from the current code and may change before launch.