Authentication

Every API request is authenticated with a bearer API key. Keys are created in the dashboard and shown exactly once - we store only a hash, so a lost key must be replaced, never recovered.

curl http://localhost:5160/v1/balance \
  -H "Authorization: Bearer lap_live_YOUR_KEY"

Key prefixes

lap_test_… keys belong to your Test project: sends are sandbox-only, free, and never leave our system. lap_live_… keys belong to your Live project: sends are real and charge your wallet. The prefix is visible in the dashboard so you can tell keys apart after creation.

Failed authentication

Missing, malformed, revoked or unknown keys all return 401 with the same body - we deliberately don't reveal whether a key exists:

{
  "error": {
    "code": "unauthorized",
    "message": "A valid API key is required."
  }
}

Rotation

To rotate a key: create a new key, deploy it, then revoke the old one from the dashboard. Revocation takes effect within seconds. There is no limit on active keys per project, so zero-downtime rotation is the normal path.

Rate limits

Requests are rate-limited per key. When you exceed the limit you get 429 rate_limited - back off and retry after a second. Queued messages are never lost to rate limiting; the limit only applies to new API requests.