API Keys

API Key Basics

Each API key:

• Is unique to a session
• Has full access to that session
• Can be revoked at any time
• Is only shown once at creation

Creating an API Key

Step-by-Step

1. Select a session from dashboard
2. Go to "API Keys" tab
3. Click "Generate New Key"
4. Copy the key immediately
5. Store it securely

⚠️ Important: The key is only shown once. If you lose it, you must create a new one.

API Key Management

View All Keys

In the API Keys tab, see:

• Key ID (first 8 characters)
• Created date
• Last used
• Status (Active/Revoked)

Revoke a Key

If a key is compromised:

1. Find the key in the list
2. Click "Revoke"
3. Confirm revocation
4. The key is immediately disabled

Key Usage Statistics

Monitor key usage:

• Requests per day
• Success rate
• Error rate
• Last used timestamp

Security Best Practices

Store Keys Safely

❌ Never do this:

// BAD: Hardcoded key
const apiKey = 'sk_live_abc123'

✅ Do this instead:

// GOOD: Environment variable
const apiKey = process.env.SENDABLE_API_KEY

Use .env Files

Create .env:

SENDABLE_API_KEY=sk_live_abc123

Add to .gitignore:

.env
.env.local
.env.production

Rotate Keys Regularly

Set a rotation schedule:

• Development: Monthly
• Production: Quarterly

Rotation process:

1. Generate new key
2. Update application config
3. Test with new key
4. Revoke old key
5. Monitor for errors

Separate Environments

Use different keys for different environments:

Use Cases

Single Application

One app, one session, one key:

App → API Key → Sendable Session

Multi-Tenant Application

Different keys for different customers:

Customer A → API Key A → Session A
Customer B → API Key B → Session B

Microservices

Each service gets its own key:

Notification Service → Key 1
Chat Service → Key 2
Marketing Service → Key 3

Troubleshooting

"Invalid API Key" Error

1. Check key is copied correctly (no extra spaces)
2. Verify key hasn't been revoked
3. Confirm key belongs to correct session
4. Ensure x-api-key header is used

Rate Limit Errors

If you see 429 Too Many Requests:

1. Check your current usage in dashboard
2. Implement retry with backoff
3. Consider upgrading your plan

Key Not Working

1. Verify session is connected
2. Check session health status
3. Try regenerating the key
4. Contact support if persists

API Key Limits

Monitoring

Track API key usage in dashboard:

• Total requests
• Failed requests
• Average response time
• Error breakdown

Set up alerts for:

• Unusual traffic spikes
• High error rates
• Key nearing rate limits