SmsGrab

Theme

Sign in English

Choose a language
Developer API

My API key has leaked. What should I do?

Revoke or rotate it at once, check its request log and create a new, restricted key.

Act at once: revoke the key in Account > Developers, or rotate it with a grace period of 0 hours. Revoking is immediate and needs no password. Then check the key's request log and your Wallet for activity you do not recognise, and create a new key with an IP allowlist and a daily spend cap. Keep keys only on servers, never in apps or web pages. See API keys and security.

Was this article helpful?

  • API keys and security Scopes, IP allowlists, daily spend caps, expiry, rotation without downtime, and what to do if a key leaks. 3 min read
  • Webhooks Receive activation events on your server in real time, verify the SmsGrab-Signature header, and understand retries, test deliveries and automatic switch-off. 4 min read
  • How much does the developer API cost? You pay per number, at the wholesale price plus a markup of 80 % that falls to 50 % with volume.
  • How many requests can I send to the API? 600 requests and 60 purchases per minute per key, 3,000 requests per minute per account, and 100 numbers waiting at once.

Still need help?

Write to us. We answer every message, usually within a few hours.

Contact support Service status

Or email us at support@smsgrab.com