Authentication

NairaSMS uses API key and API secret pairs for public developer requests. Keys are scoped, revocable, and tied to a workspace wallet.

Request Headers

Every protected developer endpoint requires both headers.

X-API-Key: pk_live_xxxxxxxxx
X-API-Secret: sk_live_xxxxxxxxx
Content-Type: application/json

Create API Key

Dashboard-authenticated users can create API keys from the developer API using their dashboard JWT.

POST/v1/keys

Option	Type	Required	Description
`name`	string	yes	Human-readable key name.
`scopes`	object	yes	Permissions such as sms, otp, campaigns, sender_ids, and balance.
`prefix`	string	no	pk_live or pk_test.
`expiresInDays`	number	no	Optional expiry window.

{
  "name": "Production website",
  "prefix": "pk_live",
  "scopes": {
    "sms": true,
    "otp": true,
    "campaigns": true,
    "sender_ids": true,
    "balance": true
  }
}

Scopes

Scopes keep integrations limited to the actions they need. A key without the required scope receives a 403 error.

Option	Type	Required	Description
`sms`	boolean	no	Send one or more SMS messages.
`otp`	boolean	no	Send and verify SMS OTPs.
`campaigns`	boolean	no	Create and inspect SMS campaigns.
`sender_ids`	boolean	no	Request and list sender IDs.
`balance`	boolean	no	Read wallet balance.