Authentication

Send your key with the App prefix, followed by a space, on every request:

Authorization: App 4a6f1c2e8b...d93eContent-Type: application/jsonAccept: application/json

Requests go to the base URL shown next to your keys in the dashboard. Always use HTTPS.

import { pulsr } from "./client";// A cheap authenticated call: fetch the most recent message logconst { results } = await pulsr("GET", "/sms/3/logs?limit=1");console.log("Key works,", results.length, "log entry returned");

• One key per environment. Create separate keys for development, staging and production, so you can revoke one without touching the others.
• Rotate without downtime. Create the new key, deploy it, then revoke the old one. Both work in the meantime.
• Revoke on leak. If a key ends up in a log, a commit or a ticket, revoke it in the dashboard right away. Requests using it fail immediately.

A key can send messages and place calls billed to your account. Call Pulsr from your backend, a serverless function or a job queue, never directly from a browser or mobile app. If your frontend needs to trigger a message, expose your own endpoint that checks who is asking, then calls Pulsr.