---
title: Authentication | SendHQ Docs
description: Use server-side API keys for product integrations and browser sessions for workspace administration.
canonical: https://sendhq.cc/docs/authentication
last-updated: 2026-09-07
---
# Authentication

Use server-side API keys for product integrations and browser sessions for workspace administration.

## API keys

Authenticate customer API requests with `Authorization: Bearer re_…`. Keys belong to one workspace and must never be embedded in browser, mobile, desktop, template, or email content.

```http
Authorization: Bearer re_your_key_here
```

## Browser sessions

The dashboard uses an HTTP-only, revocable session cookie. Billing changes and API-key creation or revocation require this browser session and are not available to bearer keys. A bearer key can read the same account, usage, and billing state through `GET /account`, dashboard analytics through `GET /analytics`, and key metadata (name, prefix, last use) through `GET /keys`.

## Rotation

1. Create a replacement key from an authenticated dashboard session.
2. Deploy the replacement to every calling service.
3. Confirm traffic uses the new prefix.
4. Revoke the old key.

## Authentication failures

A missing, expired, revoked, or unknown credential returns `401` using the standard error envelope. Do not retry authentication failures automatically.

```json
{
  "error": {
    "message": "Unauthorized — provide a valid API key or session",
    "status": 401
  }
}
```