Authentication

SendAfrica supports two independent credential types. Use an API key for server-to-server developer integrations and a JWT access token for dashboard/session flows. Account-scoped business routes can accept either when the route reference says JWT or API Key.

API keys

SendAfrica: keys begin with SA-.
MailAfrica: keys begin with MA-.

Generate and revoke SendAfrica API keys in the dashboard under Developer → API Keys. API-key management itself remains JWT-only because it changes authentication credentials.

API-key headers

The preferred developer header is:


curl https://api.sendafrica.online/v1/credits/balance \
  -H "X-API-Key: SA-your-api-key-here"

An opaque API key can also be sent as a bearer value:


curl https://api.sendafrica.online/v1/credits/balance \
  -H "Authorization: Bearer SA-your-api-key-here"

JWT access tokens use the standard bearer form:


curl https://api.sendafrica.online/v1/credits/balance \
  -H "Authorization: Bearer eyJ..."

JWT-shaped bearer tokens are distinguished from opaque API-key bearer values by their three-part JWT format. Do not send both credential types unless a specific integration requires it.

Route boundaries

Route family	API key	JWT
SMS send and logs	Yes	Yes, on JWT-compatible routes
Credits, rates, contacts, campaigns, notifications, support	Yes	Yes
Profile read/update	Yes	Yes
Password, email/phone verification, logout, OAuth linking	No	Yes
API-key creation/listing/revocation	No	Yes
Admin routes and provider callbacks	No	Separate admin or provider token

An API key is account-scoped and does not grant administrator privileges. Activity, expiration, account status, plan limits, ownership checks, and business validation still apply.

Code examples

Python


import os
from sendafrica import SendAfrica
 
client = SendAfrica(api_key=os.environ["SENDAFRICA_API_KEY"])

Node.js / TypeScript


import { SendAfrica } from 'sendafrica'
 
const client = new SendAfrica({ apiKey: process.env.SENDAFRICA_API_KEY })

PHP


$client = new SendAfrica\Client([
    'api_key' => getenv('SENDAFRICA_API_KEY'),
]);

Security rules

Keep API keys and JWTs on a trusted server. Do not embed them in browser JavaScript, mobile bundles, public Postman collections, logs, screenshots, or analytics payloads. Use a server-side proxy for browser applications, rotate keys after suspected exposure, and issue separate keys for separate environments.