Skip to main content
An API key is your system’s access card to Notifique. Without it on the request, the door won’t open.

​
What is an API key?

It’s the credential that identifies who is calling the API and which workspace they belong to. Think of a building access card: you don’t need username and password on every request, just present the card in the header. Each key starts with sk_live_... (production) or sk_test_... (sandbox).

​
What is it for?

The key connects your code to Notifique. With it you can:
  • Send messages (WhatsApp, SMS, email, push, and other channels)
  • Query history, status, and inbound messages
  • Manage instances, templates, contacts, and automations (based on selected scopes)
All without a dashboard user session. Your app server talks directly to the API.

​
Why use separate keys?

Like giving each employee their own card: if one loses theirs, you cancel just that card.

​
What you can do in the dashboard

In Developer → API Keys, you manage the workspace access cards:
  • View which integrations already have an active key
  • Create a new key with a name and permissions
  • Revoke a compromised key without affecting the others
  • Rotate access: one key per app, service, or environment
Each key belongs to a workspace (your client’s folder in the system) and defines what that integration can do.

​
Sandbox vs production

Same building, different doors:
  • Sandbox (sk_test_...): flight simulator. You test the full journey, but nothing is actually delivered. Check sends in Developer → Sandbox inbox
  • Production (sk_live_...): real flight. The message goes out and credits are used
Learn more about sandbox →

​
How to create a key

Keys are created in the dashboard. You can’t create them via the public API:
  1. Open Developer → API Keys
  2. Click Create key
  3. Name it and select the scopes: the doors this key can open
  4. Copy it immediately. It starts with sk_live_... or sk_test_...
The full key is shown only once, like a new card’s PIN. Lost it? Create another. We can’t recover it.

​
How to use in your integration

On every API call, present the card in the Authorization header:
We also accept x-api-key instead of Authorization. The full walkthrough is in Start here.

​
Best practices

  1. Never leave the key in public code. Store it in .env, like your office Wi-Fi password
  2. One key per integration. If the test app leaks, production stays safe
  3. Leaked? Revoke in Developer → API Keys and issue a new one right away
More details: Security and reliability.

​
Scopes and permissions

Scopes are the doors each key opens. Select only what your integration needs. Don’t hand out the master key if you only send SMS. Pick the channel you’ll integrate and see the full list of permissions:

WhatsApp

Send, connect number, groups

SMS

Send, query, cancel

Telegram

Send, connect bot, read messages

Instagram

Send, reply to comments

Email

Send, configure domain

Push

Send, manage apps

RCS

Send, query, cancel

Voice

Call, control, record

Templates

Create templates and send

Contacts & audience

Contacts, tags, campaigns

Automations

Flows and events

Short links

Links and conversions

Virtual numbers

Query and configure

Marketing add-ons

Forms and integrations
Door locked? See Error responses.

​
Next steps

  • Start here: send your first message
  • Webhooks: get alerts on your server, like a push notification