Splashify SMS

Docs

Open panel
Panel

Authentication

One credential: an API key, created in the panel and sent as a bearer token. Keys do not expire, so an integration does not break at 3am because a token aged out.

Creating a key

  1. Open Settings, then API keys, in the panel

    Keys are created by a signed-in person. A key cannot create another key, because a key that could mint its own replacement could not meaningfully be revoked.

  2. Give it a label

    Something that says where it will live: "production backend", "staging", "reporting script". When you come to revoke one, the label is how you know which.

  3. Copy the key

    It is shown once, on this screen, and never again.

The key is shown once and cannot be recovered

We store a hash of it, not the key. That means nobody, including us, can read it back to you: not from a support ticket, not from a backup. If it is lost, revoke it and create another. That takes seconds and is the intended path.

Sending it

As a bearer token:

bash
curl https://api.splashifypro.com/api/v1/sms/balance \
  -H "Authorization: Bearer sms_live_a1b2c3d4..."

Every key starts with sms_live_. The prefix is deliberate: it makes a key recognisable on sight in a log or a paste, and it lets a secret scanner be taught one pattern.

What a key can reach

A key that hits a panel-only endpoint gets 403 with a message saying to sign in, not 401. The distinction matters when you are debugging: 401 means the credential was not accepted, 403 means it was accepted and is not allowed there.

Looking after keys

  • One key per system, labelled. Then revoking a compromised one does not take down everything else you run.
  • Store it as a secret, in your platform's secret store or an environment variable. Not in source control, not in a config file that is committed, not in a frontend bundle where anyone viewing your site can read it.
  • Never send from a browser. A key in client-side JavaScript is public, and anyone who takes it can send messages billed to your wallet under your registered sender ID. Send from your server.
  • Rotate on a schedule you choose, and always when someone with access leaves.

Revoking

Revoke from the same panel screen. It takes effect immediately and the key returns 401 from that moment.

The record of the key stays, showing when it was created, last used and revoked. That is deliberate: during an incident, "this key was revoked at 14:20" is a useful answer and a deleted key cannot give it.

Errors

If you are sure the key is right and still get 401, check the header is literally Authorization: Bearer sms_live_... and that nothing has trimmed the sms_live_ prefix or wrapped the value in quotes.