Sendexa LogoDocs

Authentication

All Sendexa API requests use HTTP Basic Authentication with a pre-computed Base64 token you copy directly from your dashboard — no manual encoding needed.

Pre-computed Token

Copy your ready-made Base64 token directly from the dashboard — no manual encoding required

Basic Auth Standard

Industry-standard HTTP Basic Authentication supported by every HTTP client and framework

Applies to All APIs

One credential set authenticates every Sendexa API — SMS, OTP, WhatsApp, SMPP, and Webhooks

Instant Activation

New API keys are active immediately — no waiting period or verification email needed

How It Works

Sendexa uses HTTP Basic Authentication. Your API key and secret are combined and Base64-encoded to form a token. You add this token to every request's Authorization header.

1

Your credentials

Every Sendexa account has an API key and an API secret.

text
API Key:    exa_1a2b3c4d5e6f
API Secret: sk_7g8h9i0j1k2l3m4n5o6p
2

The token is pre-built for you

The dashboard Base64-encodes API_KEY:API_SECRET automatically. Just copy it.

text
ZXhhXzFhMmIzYzRkNWU2Zjpza183ZzhoOWkwajFrMmwzbTRuNW82cA==
3

Add it to every request header

Set the Authorization header on every API call.

http
Authorization: Basic ZXhhXzFhMmIzYzRkNWU2Zjpza183ZzhoOWkwajFrMmwzbTRuNW82cA==
Code Examples

Replace YOUR_DASHBOARD_BASE64_TOKEN with the token copied from your dashboard.

Bash
curl -X POST 'https://api.sendexa.co/v1/sms/send' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Basic YOUR_DASHBOARD_BASE64_TOKEN' \
  -d '{
    "to": "0244123456",
    "from": "MyBrand",
    "message": "Hello from Sendexa!"
  }'
Storing Credentials Safely

Never hardcode your token in source code. Use environment variables and load them at runtime.

Bash
# .env  — add this file to .gitignore immediately
SENDEXA_API_TOKEN=ZXhhXzFhMmIzYzRkNWU2Zjpza183ZzhoOWkwajFrMmwzbTRuNW82cA==
API Key Scopes

When creating an API key in the dashboard, you choose which scopes (permissions) it has. Follow the principle of least privilege — only grant the scopes your application actually needs.

ScopePermission
sms:sendSend single and bulk SMS messages
sms:readCheck SMS delivery status
otp:sendRequest and resend OTP codes
otp:verifyVerify OTP codes
whatsapp:sendSend WhatsApp messages
whatsapp:readRead WhatsApp message status
whatsapp:templatesManage message templates
webhooks:manageConfigure webhook endpoints
numbers:readLook up and verify phone numbers
account:readRead account and credit balance
Multiple Environments

Use separate API keys for development, staging, and production. This isolates failures, limits blast radius on a key compromise, and lets you rotate keys independently.

Development
  • Limited scopes only
  • Low credit top-ups
  • Shared with the team
Staging
  • Mirrors production scopes
  • Used in CI/CD pipelines
  • Rotated on each deploy
Production
  • Restricted access
  • Stored in secrets manager
  • Rotated every 90 days
Authentication Errors
401Unauthorized

Cause: Missing or malformed Authorization header

Fix: Ensure the header is exactly: Authorization: Basic <token>

401Invalid Credentials

Cause: Wrong API key, secret, or corrupted Base64 token

Fix: Re-copy the token from your dashboard — do not modify it

403Forbidden

Cause: Key exists but lacks permission for this endpoint

Fix: Check the key's scopes in the dashboard and add the required scope

403Account Suspended

Cause: Account suspended due to policy violation or unpaid balance

Fix: Contact [email protected] to resolve the account status

Test Your Credentials

Use the health endpoint to confirm your token is valid before making real API calls:

Bash
curl -I 'https://api.sendexa.co/v1/health' \
  -H 'Authorization: Basic YOUR_DASHBOARD_BASE64_TOKEN'


# HTTP/2 200 → credentials are valid
# HTTP/2 401 → check your token