Authentication & API Keys

The Kommify API authenticates all client requests using Bearer tokens passed in the HTTP `Authorization` header. ### API Key Types - **Live Keys (`km_live_...`)**: Used in production environments. Messages dispatched with live keys incur standard billing and reach real handsets. - **Test / Sandbox Keys (`km_test_...`)**: Used during development and CI testing. Requests are validated and simulated delivery receipts are generated without sending carrier traffic. ### Best Practices - Never commit secret API keys into client-side code or public version control. - Store keys in environment variables or cloud secret managers (e.g. AWS Secrets Manager, Doppler, Vault). - Rotate compromised keys immediately via the Kommify Security Console.

curl -H "Authorization: Bearer km_live_your_secret_key" \
     https://api.kommify.com/v1/account