API Key

An API Key is a unique authentication token that identifies and authorizes your application when making API requests to SendSeven. It acts as a digital credential proving you have permission to access the API.

What is an API Key?

An API Key (also called API token or access key) is a unique alphanumeric string that serves as an authentication mechanism for REST API access. When you register with SendSeven, you receive an API Key that your application includes with every request -- typically as a Bearer Token in the Authorization header. The API Key not only identifies your account but also controls permissions, rate limits, and billing.

Technically, the key is validated with every HTTP request: Does it match an active key in the database? Is the associated account active? Does it have sufficient credits? Only after successful validation is the request processed. This architecture protects both your data and the infrastructure from misuse.

Why is an API Key Important?

The API Key is the central security barrier between the public internet and your messaging infrastructure. No key, no API access -- it is that simple. It prevents unauthorized parties from sending messages on your behalf, reading contacts, or manipulating webhooks. At the same time, it enables precise tracking: which application made how many requests? Where did an error occur?

An often overlooked aspect: API Keys are cost centers. Every sent message is attributed to the associated key. If you run multiple applications (e.g., marketing tool, support system, automation) or need to secure webhook signatures, you should use separate keys -- this lets you analyze usage and costs granularly. SendSeven allows multiple keys per account, each with its own name and optionally restricted permissions.

Best Practices for API Key Security

Never expose in frontend code: API Keys belong exclusively in backend code. JavaScript running in the browser is publicly readable -- a key stored there is compromised within seconds. Instead, use a dedicated backend endpoint that securely manages the key and forwards requests to SendSeven.

Use environment variables: Never store keys directly in source code. Use environment variables (.env files) and explicitly exclude them from version control (.gitignore). This prevents accidental leaks on GitHub or GitLab.

Rotate regularly: Like passwords, API Keys should be renewed periodically -- especially after team member changes or suspected compromise. SendSeven allows creating new keys while old ones remain active in parallel (for graceful migration).

Monitor usage: Watch API usage for anomalies. Suddenly 10,000 requests per minute? A compromised key could be abused to send spam -- at your expense and at the cost of your reputation.

API Key Management with SendSeven

In the SendSeven Dashboard, you can create API Keys in just a few clicks. Each key gets a name (e.g., "Production Server", "Test Environment"), a creation date, and optionally restricted permissions (e.g., read-only, no sending). You can deactivate or delete keys at any time -- active requests with a deactivated key are immediately rejected with HTTP 401 (Unauthorized).

The SendSeven API uses the Bearer Token scheme. Your requests look like this:

Authorization: Bearer YOUR_API_KEY

All requests run over HTTPS (TLS 1.3), ensuring the key is transmitted encrypted. For a complete walkthrough, see the API Authentication Guide. Rate limits and error handling are documented at docs.sendseven.com -- including code examples for Node.js, Python, and PHP.