Authentication
To access any endpoints in the Velstack API, you must authenticate your requests. The Velstack API uses API keys for authentication, which must be included in the Authorization header of each request. You can view and manage your API keys in the Velstack Dashboard.
There are two types of API keys:
Public Key (pk_live__): Used in your front-end for client-side integrations and certain services. Public keys cannot modify account data or perform sensitive operations.
Secret Key (sk_live): Used in your back-end server. Must be kept confidential and never exposed in client-side code.
Public keys are intended for use in your front-end when integrating with Velstack services. By design, public keys cannot modify any part of your account, except for initiating SMS campaigns. Conversely, secret keys must be kept confidential. If you suspect that your secret key has been compromised or need to reset it, you can do so from the dashboard.
Your SECRET_KEY is critical to your account, so be sure to keep them secure! Do not share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth. Settings » Developer.
Authorization format
Authorization headers should use your Secret Key in the format: Authorization: Bearer sk_live_your_key
<span><span style="color: var(--shiki-color-text)">curl https://api.velstack.com/v/sms/quick \</span></span> <span><span style="color: var(--shiki-color-text)">-H </span><span style="color: var(--shiki-token-string-expression)">"Authorization: Bearer sk_live_your_key"</span></span> <span></span>
For client-side requests, use your Public Key in the format: Authorization: Bearer pk_live_your_key
Always keep your secret key safe and reset it if you suspect it has been compromised.
Important: Each endpoint specifies whether it requires a Public Key (pk_live__) or Secret Key (sk_live). Refer to the endpoint documentation to determine which key to use.
API requests made without authentication will fail with the status code 401: Unauthorized.
All API requests must be made over HTTPS.