Authentication

Use an account-scoped developer API key for server-to-server integrations.

Recommended: X-API-Key

curl https://api.sendafrica.online/v1/credits/balance \
  -H "X-API-Key: $SENDAFRICA_API_KEY"

Bearer authentication is also supported:

curl https://api.sendafrica.online/v1/credits/balance \
  -H "Authorization: Bearer $SENDAFRICA_API_KEY"

Keep credentials server-side

API keys must stay in a trusted backend, worker, or serverless function. Never embed them in browser JavaScript, mobile app bundles, public Postman collections, logs, screenshots, or analytics payloads.

Use separate keys for development, staging, and production. Rotate a key immediately after suspected exposure.

API-key creation, listing, and revocation are dashboard credential-management operations; they are intentionally not documented as public API endpoints here.