Authentication

The two surfaces

Surface	Method	Header	Usage
Dashboard	JWT Bearer	`Authorization: Bearer <jwt>`	Web interface and console `/api/*` endpoints
Public API	API key	`x-api-key: <api_key>`	`/api/v1/*` endpoints for server-to-server integrations

For any server-to-server integration, use an API key.

The web console and the public API do not use the same authentication method.

API key format

A MsgFlash API key looks like this:

msgf_live_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2

Structure:

prefix msgf_live_
64 lowercase hexadecimal characters

The full key is only shown once when it is created.

Using your API key

curl https://srv.msgflash.com/api/v1/messages/send \
  -H "x-api-key: msgf_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "instanceId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "to": "+33612345000",
    "type": "text",
    "text": "Hello"
  }'

Do not use Authorization: Bearer <api_key> for the public API. The backend explicitly expects the x-api-key header.

Creating and revoking a key

Sign in to app.msgflash.com
Open API Keys
Click New API Key
Give it a descriptive name
Copy the key immediately

To revoke a key:

Go back to API Keys
Click Revoke
Confirm

Revocation is immediate.

Dashboard authentication

The main dashboard flows are:

signup
login
Google OAuth
email verification
password reset

Detailed guide: See the dashboard auth guide

Number of keys per plan

Plan	Allowed API keys
Free	1
Starter	3
Pro	10
Plus	10

Best practices

One key per environment

Use separate keys for production, staging, and development.

Environment variables

Store your key in an environment variable such as MSGFLASH_API_KEY or in a secrets manager.

Code	HTTP	Description
`UNAUTHORIZED`	401	Missing, invalid, or revoked key
`FORBIDDEN`	403	The key is valid but cannot access the resource
`SUBSCRIPTION_INACTIVE`	403	The account no longer has an active subscription for the requested action
`API_RATE_LIMIT_EXCEEDED`	429	More than 10 requests/second on the same key
`MONTHLY_API_REQUEST_QUOTA_EXCEEDED`	429	Monthly API request quota exhausted

Example:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or revoked API key"
  }
}

Getting Started

Guides

API Reference · Teams

API Reference · Instances

API Reference · Messages

API Reference · Campaigns

API Reference · Templates

API Reference · Contacts

API Reference · Groups

API Reference · Number Lookups

API Reference · Webhooks

API Reference · Billing

Resources

The two surfaces

API key format

Using your API key

Creating and revoking a key

Dashboard authentication

Number of keys per plan

Best practices

One key per environment

Environment variables

​The two surfaces

​API key format

​Using your API key

​Creating and revoking a key

​Dashboard authentication

​Number of keys per plan

​Best practices

One key per environment

Environment variables

​Authentication-related errors

The two surfaces

API key format

Using your API key

Creating and revoking a key

Dashboard authentication

Number of keys per plan

Best practices

Authentication-related errors