Authentication
Every request to the REST API carries your API key in a header. One key per account, issued after the first top-up, revocable from the dashboard at any time.
How do I authenticate to the SMS Nitro API?
Send your key in the X-Api-Key header (Authorization: Bearer <key> also works) on every request to https://smsnitro.com/api/v1. A missing, wrong or revoked key returns 401 with the detail Invalid or revoked API key.
Getting the key
- API access unlocks after your first confirmed top-up.
- Open Dashboard > API and generate the key. It is shown once, so copy it to a secret store right away.
- Each account has one active key. Generating a new one revokes the previous key immediately.
Sending the key
Both header formats are accepted on every endpoint. Pick one and use it everywhere.
| Header | Example |
|---|---|
| X-Api-Key | X-Api-Key: <your key> (recommended) |
| Authorization | Authorization: Bearer <your key> |
curl https://smsnitro.com/api/v1/balance \
-H "X-Api-Key: $SMSNITRO_API_KEY"curl https://smsnitro.com/api/v1/balance \
-H "Authorization: Bearer $SMSNITRO_API_KEY"Keeping the key safe
The key can spend your balance, so treat it like a password.
- Keep it in an environment variable or a secret manager, never in the source code.
- Call the API from your server only. Never ship the key in a browser, mobile app or desktop client.
- Do not paste it in tickets, logs or screenshots.
- If it leaks, generate a new key in the dashboard: the old one stops working at once.
# .env (never commit this file)
SMSNITRO_API_KEY=your-key-from-the-dashboardFrequently asked questions
Can I have several keys?
No. Each account has one active key; generating a new one replaces it.
Does the key expire?
No. It stays valid until you generate a new one in the dashboard.