> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Learn how API keys work and how to use them to access Notifique.

<Tip>
  An API key is your system's **access card** to Notifique. Without it on the request, the door won't open.
</Tip>

## What is an API key?

It's the credential that identifies **who** is calling the API and **which workspace** they belong to. Think of a building access card: you don't need username and password on every request, just present the card in the header.

Each key starts with `sk_live_...` (production) or `sk_test_...` (sandbox).

## What is it for?

The key connects your code to Notifique. With it you can:

* **Send** messages (WhatsApp, SMS, email, push, and other channels)
* **Query** history, status, and inbound messages
* **Manage** instances, templates, contacts, and automations (based on selected scopes)

All without a dashboard user session. Your app server talks directly to the API.

## Why use separate keys?

| Situation                         | What to do                                    |
| --------------------------------- | --------------------------------------------- |
| Production app + test app         | One key for each                              |
| Two systems in the same workspace | One key per integration                       |
| A key leaks                       | Revoke only that one; the others keep working |

Like giving each employee their own card: if one loses theirs, you cancel just that card.

## What you can do in the dashboard

In **Developer → API Keys**, you manage the workspace access cards:

* **View** which integrations already have an active key
* **Create** a new key with a name and permissions
* **Revoke** a compromised key without affecting the others
* **Rotate** access: one key per app, service, or environment

Each key belongs to a workspace (your client's **folder** in the system) and defines what that integration can do.

## Sandbox vs production

Same building, different doors:

* **Sandbox** (`sk_test_...`): **flight simulator**. You test the full journey, but nothing is actually delivered. Check sends in **Developer → Sandbox inbox**
* **Production** (`sk_live_...`): **real flight**. The message goes out and credits are used

[Learn more about sandbox →](/guides/sandbox/index)

## How to create a key

Keys are created in the dashboard. You can't create them via the public API:

1. Open **Developer → API Keys**
2. Click **Create key**
3. Name it and select the [scopes](#scopes-and-permissions): the doors this key can open
4. Copy it immediately. It starts with `sk_live_...` or `sk_test_...`

<Warning>
  The full key is shown **only once**, like a new card's PIN. Lost it? Create another. We can't recover it.
</Warning>

## How to use in your integration

On every API call, present the card in the `Authorization` header:

```http theme={null}
Authorization: Bearer sk_live_xxxxx
```

We also accept `x-api-key` instead of `Authorization`. The full walkthrough is in [Start here](/guides/introducao/comece-aqui).

## Best practices

1. **Never** leave the key in public code. Store it in `.env`, like your office Wi-Fi password
2. **One key per integration**. If the test app leaks, production stays safe
3. **Leaked?** Revoke in **Developer → API Keys** and issue a new one right away

More details: [Security and reliability](/guides/conceitos/seguranca-e-confiabilidade).

## Scopes and permissions

Scopes are the **doors** each key opens. Select only what your integration needs. Don't hand out the master key if you only send SMS.

Pick the channel you'll integrate and see the full list of permissions:

<CardGroup cols={2}>
  <Card title="WhatsApp" icon="whatsapp" href="/whatsapp-api/como-funciona/escopos-api-key">
    Send, connect number, groups
  </Card>

  <Card title="SMS" icon="comment-sms" href="/sms-api/como-funciona/escopos-da-api-key">
    Send, query, cancel
  </Card>

  <Card title="Telegram" icon="paper-plane" href="/telegram-api/como-funciona/escopos-api-key">
    Send, connect bot, read messages
  </Card>

  <Card title="Instagram" icon="instagram" href="/instagram-api/como-funciona/escopos-api-key">
    Send, reply to comments
  </Card>

  <Card title="Email" icon="envelope" href="/emails-api/como-funciona/escopos-da-api-key">
    Send, configure domain
  </Card>

  <Card title="Push" icon="bell" href="/push-api/como-funciona/escopos-da-api-key">
    Send, manage apps
  </Card>

  <Card title="RCS" icon="mobile-screen" href="/rcs-api/como-funciona/escopos-da-api-key">
    Send, query, cancel
  </Card>

  <Card title="Voice" icon="phone" href="/voice-api/como-funciona/escopos-da-api-key">
    Call, control, record
  </Card>

  <Card title="Templates" icon="layer-group" href="/template-api/como-funciona/escopos-da-api-key">
    Create templates and send
  </Card>

  <Card title="Contacts & audience" icon="address-book" href="/contacts-api/como-funciona/escopos-da-api-key">
    Contacts, tags, campaigns
  </Card>

  <Card title="Automations" icon="diagram-project" href="/automations-api/como-funciona/escopos-da-api-key">
    Flows and events
  </Card>

  <Card title="Short links" icon="link" href="/short-links-api/como-funciona/escopos-api-key">
    Links and conversions
  </Card>

  <Card title="Virtual numbers" icon="hashtag" href="/phone-numbers-api/como-funciona/escopos-da-api-key">
    Query and configure
  </Card>

  <Card title="Marketing add-ons" icon="puzzle-piece" href="/marketing-addons-api/como-funciona/escopos-api-key">
    Forms and integrations
  </Card>
</CardGroup>

Door locked? See [Error responses](/guides/conceitos/resposta-de-erros).

***

## Next steps

* [Start here](/guides/introducao/comece-aqui): send your first message
* [Webhooks](/guides/webhooks/index): get alerts on your server, like a push notification