Developer console
Keys, webhooks and every event — governed.
One console manages API keys, webhooks, logs and security for your integration: scoped keys that rotate themselves, signed webhooks with retries and replay, and an audit trail that can prove it.
- Sandbox keys before go-live
- 2FA on privileged actions
- Hash-chained audit
API Keys 4
Create API keyRotating keys hand over to a successor — the old secret keeps working through the grace period.
API keys
Keys that expire, rotate and answer for themselves
Create a key in one modal — name, live or test mode, scopes, validity, IP allowlist, auto-rotation and a rate limit — and the secret is shown exactly once.
Scoped, not almighty
Every key carries explicit group:action scopes — messages:send, templates:read — and admin scopes are owner-only.
Expiry you choose
7 days to permanent, with custom dates. Auto-rotation on an interval you set, from 1 to 365 days.
Fenced by network
An optional IP allowlist pins each key to your infrastructure; a per-key rate limit (10–10,000 req/min) caps the blast radius.
Live and test, side by side
Sandbox keys work before your number goes live, and every key page shows usage, latency percentiles, logs and audit history in its own tabs.
Webhooks
Deliveries you can trust, failures you can replay
Platform events reach your HTTPS endpoints signed, retried and circuit-protected — with a health probe that tells you why something is slow before your customers do.
Signed and verified
Every delivery is signed; the signing secret is shown once at creation and rotates with a grace period so old signatures keep verifying while you deploy.
Retries, then replay
Failed deliveries retry with backoff up to your attempt limit. Anything dead-lettered can be replayed — one delivery or a filtered bulk range with a preview of exactly what will be resent.
A circuit breaker, visible
A flapping endpoint trips the circuit instead of hammering your servers. The console shows the live circuit state, consecutive failures and a probed health verdict.
Live, not polled
Deliveries, circuit changes and replay progress stream into the open page over sockets — no refresh loop.
DNS
12 ms
resolves
TLS handshake
38 ms
cert valid
First byte
141 ms
reachable
Last 10 deliveries
98%
p99 620 ms
Deliveries, circuit changes and replay progress stream in live while the page is open.
Governed by default
The parts your security team will read twice
The same discipline everywhere in the console — for API keys and webhooks alike.
2FA on every privileged action
Create, rotate, revoke, delete, scope changes, bulk pause — each confirms with a 6-digit code inline. No standing god-mode.
Secrets shown exactly once
A new or rotated secret appears in one dedicated reveal, then never again. If it wasn't copied, it gets rotated — not recovered.
Danger zones, isolated
Destructive actions live in a red-bordered card apart from everyday settings — and for read-only users the card doesn't render at all.
Tamper-evident audit trails
Key and webhook history is a hash-chained log: every row links to the previous one, and the console verifies the chain as you read it.
Permissions per action
View, create and write are separate grants; audit tabs only exist for writers, and plan entitlements gate features on top.
Sessions you can end
Every active API-key session — device, location, last active — in one table, with a 2FA-backed kick for anything that shouldn't be there.
Ship the integration, keep the receipts.
Sandbox keys work before your number goes live — create one now and send your first test message today.