Authentication

Use an account-scoped developer API key for server-to-server integrations.

Recommended: X-API-Key

curl https://api.sendafrica.online/v1/credits/balance \
  -H "X-API-Key: $SENDAFRICA_API_KEY"

Bearer authentication is also supported:

curl https://api.sendafrica.online/v1/credits/balance \
  -H "Authorization: Bearer $SENDAFRICA_API_KEY"

The SDKs set both headers for you — you only supply the key at construction.

Where keys are not enough

Webhook endpoint management (creating, listing, disabling, rotating secrets) is authenticated with your developer portal session token and scoped to the API key you address. See Webhooks.

Keep credentials server-side

API keys must stay in a trusted backend, worker, or serverless function. Never embed them in browser JavaScript, mobile app bundles, public Postman collections, logs, screenshots, or analytics payloads.

Use separate keys for development, staging, and production. Rotate a key immediately after suspected exposure.

When to use a dashboard JWT

The dashboard exposes account operations (credits history, sender-id management, campaign tooling) through short-lived JWTs. The SDKs can authenticate with a bearer token — for example the TypeScript SDK’s logsJwt(jwtToken, ...) — when you are acting on behalf of a dashboard session. For normal server integrations, an API key is the right choice.

API-key creation, listing, and revocation are dashboard credential-management operations; they are intentionally not documented as public API endpoints here.