Authentication

Generate a key from your developer dashboard — Keys → Create new key. You'll see the full plaintext key exactly once, at creation; store it somewhere safe, since SamaPrime only ever keeps a hashed copy.

Send it as a standard Bearer token: Authorization: Bearer sk_live_.... Test keys use the sk_test_ prefix instead and never move real money.

A key carries its own scopes (e.g. wallet.read, sms.purchase) — a request against an endpoint your key wasn't granted returns 403 Forbidden. Create separate keys per integration so a compromised key exposes the smallest surface possible.

A missing or invalid token returns 401 Unauthorized. Never send your key from a browser or client app — it belongs on your own server only.