Authentication
API keys, live and sandbox, and what a key can reach.
Every call carries an API key, in either header:
X-API-KEY: gw_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Authorization: Bearer gw_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxCreating a key
Keys are made in the console, on the API keys page, where you sign in with your Swarmhit account. A key's full value is shown once, when it is made; it can expire on a date you choose and be revoked at any time. Give each service of yours its own key, so one can be revoked alone.
| Key | Starts with | Reaches |
|---|---|---|
| Live | gw_live_ | Your real accounts. Billed. |
| Sandbox | gw_test_ | Sandbox accounts only, played by Swarmhit. Never billed. |
A sandbox key never sees a live account and a live key never sees a sandbox one. See Sandbox.
What a key reaches
- Its services. A key is made for some channels (LinkedIn, WhatsApp, email); a route
of another one answers
403 errors/forbidden. - Your accounts only. An account, chat, message or attendee of anyone else answers
404, exactly as one that does not exist, wherever the call names it (path,account_idin the query or the body, a multipart field). Lists across accounts list yours only.
When a key is refused
| Answer | When |
|---|---|
401 errors/unauthorized | The key is missing, wrong, revoked or expired. Nothing is done. |
402 errors/payment_required payment-method-required | Your plan costs money and no valid card is on file: live keys are refused until you add one on the console's Billing page. Sandbox keys keep working. |
402 errors/payment_required payment-failed | The charge for a new account was declined: the account was not created. Check the card, then retry. |
403 errors/client_suspended | Your company's access is suspended: every call is refused and your accounts are stopped until it is active again. Your accounts resume within minutes after that; one you paused stays paused. |
Each billing cycle is charged in advance at its start, so the first account you create is paid for before it is created.
Only /health, /whatsapp/health, /email/health and the live view (/li-live/<token>,
guarded by its single-use token) need no key.