Authentication
Your server authenticates with an API key sent in the x-api-key header on every request.
curl https://api.99billingsolutions.com/v1/messages?limit=5 \
-H "x-api-key: sk_live_…"Creating and revoking keys
- Create keys in Settings → API keys. A key starts with
sk_live_and is shown once — copy it into your server's environment variables. - Give each integration its own key so you can revoke one without breaking the others.
- An optional expiry date makes a key stop working automatically.
- We store only a hash of the key. If you lose it, revoke it and create a new one.
What a key can do
A key acts for your whole workspace: sending and listing messages, campaigns, contacts, templates, webhooks, devices and analytics. Account settings — API keys, AI keys and persona, team members, workspace mode — can only be changed by a signed-in user in the portal.
Keep keys server-side
Never put a key in a browser, mobile app or public repository: anyone holding it can send SMS from your phones. If a key leaks, revoke it immediately in the portal.
Authentication errors
| Code | HTTP | Meaning |
|---|---|---|
invalid_api_key | 401 | Header missing, or the key does not exist. |
key_revoked | 401 | The key was revoked in the portal. |
key_expired | 401 | The key passed its expiry date. |
account_suspended | 403 | The workspace is suspended. Contact support. |
Phone keys
Each paired phone gets its own key automatically during pairing. The Android app uses it to report sent, delivered and received messages. You never need to handle it; unpairing a phone in Phones revokes it.