# Authentication

Every request to the REST API carries your API key in a header. One key per account, issued after the first top-up, revocable from the dashboard at any time.

## How do I authenticate to the SMS Nitro API?

Send your key in the X-Api-Key header (Authorization: Bearer <key> also works) on every request to https://smsnitro.com/api/v1. A missing, wrong or revoked key returns 401 with the detail Invalid or revoked API key.

## Getting the key

- API access unlocks after your first confirmed top-up.
- Open Dashboard > API and generate the key. It is shown once, so copy it to a secret store right away.
- Each account has one active key. Generating a new one revokes the previous key immediately.

## Sending the key

Both header formats are accepted on every endpoint. Pick one and use it everywhere.

| Header | Example |
|---|---|
| X-Api-Key | X-Api-Key: <your key> (recommended) |
| Authorization | Authorization: Bearer <your key> |

**X-Api-Key**

```bash
curl https://smsnitro.com/api/v1/balance \
  -H "X-Api-Key: $SMSNITRO_API_KEY"
```

**Bearer**

```bash
curl https://smsnitro.com/api/v1/balance \
  -H "Authorization: Bearer $SMSNITRO_API_KEY"
```

## Keeping the key safe

The key can spend your balance, so treat it like a password.

- Keep it in an environment variable or a secret manager, never in the source code.
- Call the API from your server only. Never ship the key in a browser, mobile app or desktop client.
- Do not paste it in tickets, logs or screenshots.
- If it leaks, generate a new key in the dashboard: the old one stops working at once.

**Environment variable**

```bash
# .env (never commit this file)
SMSNITRO_API_KEY=your-key-from-the-dashboard
```

## FAQ

**Can I have several keys?** No. Each account has one active key; generating a new one replaces it.

**Does the key expire?** No. It stays valid until you generate a new one in the dashboard.

Source: https://smsnitro.com/developers/authentication