Authentication - Sendbaze

Every request carries an API key in the Authorization header:

curl https://api.sendbaze.com/v1/usage \
  -H "Authorization: Bearer sk_live_xxxxxxxx"

Create keys on the API keys page of the dashboard. The full key is shown once; Sendbaze stores only a SHA-256 hash.

Key modes

Prefix	Behaviour
`sk_live_`	Sends real email and SMS from verified domains. Counts against your allowance.
`sk_test_`	Runs every validation, returns real-looking ids, appears in the logs with a test badge, never sends and never counts.

Scopes

A key only does what its scopes allow. A request outside its scopes is 403 insufficient_scope.

Scope	Endpoints
`emails:send`	`POST /v1/emails`, `/v1/emails/batch`; write `/v1/templates`, `/v1/suppressions`
`sms:send`	`POST /v1/sms`, `/v1/sms/batch`
`domains:write`	`POST /v1/domains`, `/v1/domains/{id}/verify`, `DELETE /v1/domains/{id}`
`webhooks:write`	Write `/v1/webhooks`, test, replay
`read`	Every `GET`, `POST /v1/templates/{id}/render`, `GET /v1/usage`

Organisations

Keys belong to an organisation. A key only sees the organisation’s own messages, domains, templates and endpoints; ids from another organisation are 404 not_found. The dashboard’s organisation switcher chooses which organisation’s keys you are managing.

Failures

Code	Status	Cause
`unauthorized`	401	No header, wrong scheme, unknown or revoked key. The response also carries `WWW-Authenticate: Bearer`.
`insufficient_scope`	403	The key lacks the scope this endpoint needs.
`org_suspended`	403	The organisation is suspended.