Authentication
Every request is authenticated with an API key in the Authorization header:
bash
Authorization: Bearer ghost_sk_test_...Test and live keys
| Prefix | Mode | Behavior |
|---|---|---|
ghost_sk_test_ | Sandbox | Instant, free, simulated delivery — no real SMS ever leaves the sandbox. |
ghost_sk_live_ | Live | Real numbers and real delivery. Mintable once your account has live access. |
Keys never expire, but you can roll or revoke them anytime from the console. Rolling revokes the old key immediately and mints a replacement.
Storage
Keys are stored hashed (SHA-256) — we can never display a key again after minting it. If you lose one, roll it.
Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | invalid_api_key | Missing, malformed, revoked, or unknown key. |
| 403 | live_access_required | Live key used before live access was granted, or a live-only endpoint hit with a test key. |
| 403 | tenant_suspended | The account is suspended. |