Skip to main content
Every request needs your workspace API key as a bearer token in the Authorization header:

​
API keys

Workspace owners and admins find the key in Blujay under API in the sidebar, in the API Token card. Use the eye button to reveal it. A workspace has one API key today. It has full access to its workspace: it can send messages from your numbers and read every chat. Treat it like a password.
  • Keep it on your server, in an environment variable or a secret manager.
  • Never put it in a web page, a mobile app, a URL or source control.
  • Don’t log it, and don’t send it to support. Send the trace_id instead.
Call the API from your server. Browsers block requests to the API from other websites, so code running in a web page can’t call it directly, and shouldn’t: it would expose your key. Send requests from your backend and pass the results to your page.
To rotate the key, or if it leaks, email support@blujay.io. There is no self-service rotation and no second key yet. A revoked key returns API_KEY_REVOKED. The key from the API tab doesn’t expire; a key that support issued with an expiry date returns API_KEY_EXPIRED after that date.

​
Test and live

There is one mode: live. Keys don’t have a test or sandbox variant, and every call acts on your real workspace. Messages you send are delivered, and contacts you create are saved. To test safely:
  • Send to your own phone number first.
  • Use a clear prefix in your Idempotency-Key values (for example test-…) so you can find test sends quickly.
  • Point a webhook subscription at a test endpoint. If you have more than one number, filter the subscription to the number you test with. See Select phone numbers.

​
Check a credential

GET /v1/me tells you which workspace and key a request uses:
credential and api_key describe the same key. Prefer credential; api_key stays for older clients. Credential IDs are plain UUIDs, not prefixed IDs.

​
Authentication errors

Repeated failed authentication from one IP address is limited to 60 attempts a minute. See Rate limits.

​
Next steps

Quickstart

Send your first message in about five minutes.

Making requests

Response format, IDs, pagination and tracing.