API Authentication & Tokens
Learn how to create and manage API tokens with scoped permissions. Secure your integrations with proper authentication practices.
Verify the token is correct and complete
Check that the token hasn't been revoked
Ensure you're using Bearer authentication
Confirm there are no extra spaces in the header
API tokens are secure credentials that allow your applications and integrations to authenticate with SendSeven's REST API without exposing your password. Instead of using a single master token with unlimited access, SendSeven supports scoped tokens — each token can be restricted to specific permissions like reading messages, sending broadcasts, managing webhooks, or accessing reports. This follows security best practices by enforcing the principle of least privilege. You can create unlimited tokens, each with different names and permissions, and revoke any token instantly if it is compromised or no longer needed.
A SendSeven account (sign up free at app.sendseven.com)
Admin or Owner role in your SendSeven workspace
SendSeven Settings page showing the empty API Tokens section before any tokens are created
Create API Token dialog showing token name field and permission scopes such as read, write, and webhooks
Token created successfully popup displaying the generated API token to copy before it disappears
This is the only time you'll see the full token. If you lose it, you'll need to create a new one. Store it securely in your environment variables or a secrets manager.
Active API token entry showing assigned permission scopes and management options in SendSeven
Never hardcode tokens in your source code. Use environment variables or a secrets manager instead.
Periodically create new tokens and revoke old ones, especially for production systems. This limits exposure if a token is compromised.
Create different tokens for different integrations. If one token is compromised, you can revoke it without affecting other services.
Only request the scopes your integration actually needs. Follow the principle of least privilege to reduce risk.
Delete tokens that are no longer in use. Check your token list regularly and remove any that are obsolete.
- Generate an API key
- Understand authentication methods
- Add the API key to request headers
- Handle authentication errors
- Rotate API keys securely
- Set up API key permissions
FAQ
What are API scopes?
API scopes define the permissions your token has. Instead of giving full access, you can limit tokens to specific actions like reading contacts, sending messages, managing webhooks, or accessing reports. This follows the principle of least privilege for security.
Can I create multiple tokens?
Yes. You can create unlimited API tokens, each with different scopes and names. This is useful for giving different third-party integrations or team members only the permissions they need.
Do API tokens expire?
API tokens do not expire automatically. They remain valid until you manually revoke them. You can monitor active tokens in the API settings dashboard.
How do I use the token in API calls?
Include your token as a Bearer token in the Authorization header. Example: Authorization: Bearer your_api_token_here. All requests are sent over HTTPS.
Can I revoke a token instantly?
Yes. Any token can be revoked instantly from the API settings page. Revocation is immediate — the token stops working right away for all new requests.
What are the available permission scopes?
SendSeven offers granular scopes including: messages:read/write, contacts:read/write, channels:read/write, reports:read, webhooks:read/write, integrations:read/write, and audit:read for compliance logging.
How are API requests rate limited?
API rate limits depend on your plan. Rate limit headers are returned with each response so you can monitor your usage. Contact support if you need higher limits.