# Authentication The API authenticates every request with a bearer **API key** sent in the `Authorization` header. ```bash Authorization: Bearer sk_live_… ``` ## Keys - **Test keys** (`sk_test_…`) run against the sandbox with test numbers — no real messages, no charges. - **Live keys** (`sk_live_…`) send real traffic and bill carrier pass-through. An API key carries full account access. **Never** ship it in client-side code, a mobile app, or a public repo. Keep it on your server and inject it from an environment variable or secret manager. ## Making an authenticated request ```bash curl https://api.netexem.com/v1/contacts \ -H "Authorization: Bearer $NETEXEM_API_KEY" ``` A missing or invalid key returns `401 Unauthorized`. See [Errors](/developers/docs/errors) for the full error shape. ## Rotating keys Create a new key before retiring the old one so there is no downtime, deploy the new value, then revoke the previous key. Revocation takes effect immediately. ## Webhook authenticity API keys authenticate requests **you** make. To verify requests **we** send to your webhook endpoint, validate the HMAC-SHA256 signature — see [Webhooks](/developers/docs/webhooks).