Get started

One key, one workspace, one role. The key acts as itself.

• A key belongs to one workspace. Everything it reads or writes is scoped to that workspace; anything from another one answers 404, never 403.
• A key acts as itself, not as the person who created it. Messages it sends carry the key's label. Removing that person does not revoke the key.
• A key has a role: member reads, agent also writes to conversations and contacts, admin also manages webhooks, templates and settings. Each route states the role it needs.
• Keys are created and revoked in the console, in a signed-in session. A revoked key is refused on its very next call.
• Keys do not expire. Rotate them by creating a new one, deploying it, then revoking the old one.

Limits

600 calls per minute per key. Above that you get 429 with rate_limited and a Retry-After header in seconds. Free-text replies (POST /inbox/conversations/{id}/messages) have their own limit, 30 per minute per key; templates do not. To send in volume without waiting on each call, use queue: true (see Sending).

Your calls, logged

Every call made with a key over the last 30 days is listed in the console (API keys › Recent calls) and by GET /api-requests: address, status, error code, duration, request id. No body, header or query string is kept.