Authentication and scopes

API keys

Send the key in the Authorization header: Authorization: Bearer <key>. Keys look like sndd_test_... or sndd_live_.... Sendd stores only a hash and shows the secret once, when the key is created.

Every key expires: 365 days by default, at most 730. A missing, invalid, expired or revoked key is 401 unauthorized.

Scopes

A key calls only the operations its scopes allow; anything else is 403 insufficient_scope. The API reference lists each operation's scopes under x-sendd-scopes, where [] means signed-in dashboard members only.

• messages:send: send single messages (POST /v1/messages).
• messages:read: list messages and read one, with its status.
• campaigns:read: read campaigns, their messages and export, and the sending window.
• campaigns:write: create, edit, quote and discard campaign drafts (live keys only).
• sender_ids:read: list the organization's sender IDs.
• wallet:read: the wallet balance and the ledger.
• webhooks:read: list webhook deliveries and their attempts.

What a key can never do

Keys never manage API keys, members, contacts or webhook endpoints, never launch or cancel a campaign, never top up the wallet and never request a sender ID. Those need a signed-in member whose role allows it, so a leaked key cannot mint keys or send your events elsewhere.

Test and live keys

Test keys never reach a provider or the wallet, and any member who manages keys may give them any scope.

Live keys need an organization Sendd has verified (403 organization_not_verified), and each scope must be something the creator's role may do itself (403 scope_exceeds_role). An organization has at most 20 active keys.

Rotation and revocation

Rotating a key creates a replacement with the same name, mode and scopes; the old key keeps working for a grace period (24 hours by default, at most 168). Revoking a key takes effect immediately.