#Authentication

The API authenticates every request with a bearer API key sent in the Authorization header.

Authorization: Bearer sk_live_…

#Keys

Test keys (sk_test_…) run against the sandbox with test numbers — no real messages, no charges.
Live keys (sk_live_…) send real traffic and bill carrier pass-through.

An API key carries full account access. Never ship it in client-side code, a mobile app, or a public repo. Keep it on your server and inject it from an environment variable or secret manager.

#Making an authenticated request

curl https://api.netexem.com/v1/contacts \
  -H "Authorization: Bearer $NETEXEM_API_KEY"

A missing or invalid key returns 401 Unauthorized. See Errors for the full error shape.

#Rotating keys

Create a new key before retiring the old one so there is no downtime, deploy the new value, then revoke the previous key. Revocation takes effect immediately.

#Webhook authenticity

API keys authenticate requests you make. To verify requests we send to your webhook endpoint, validate the HMAC-SHA256 signature — see Webhooks.