Concepts
Businesses, keys, modes and channels — the four things to know.
Business
Everything — keys, providers, templates, logs, branding — belongs to a business. One account can own several; teammates join with a role (owner, admin, member).
API keys
| Prefix | Mode | Sends through |
|---|---|---|
vm_live_… | live | your live provider profiles, billed |
vm_test_… | test | test profiles, test targets, never billed |
Send it in the x-api-key header, from your server only. A key can be
limited to scopes (send, verify, read, full), an expiry, and rotated
from the console. It is shown exactly once.
Channels and providers
provider in a request picks where the code goes:
| Value | Goes to |
|---|---|
sms · email · whatsapp · telegram | the business's default profile for that channel |
sms:<slug> | one specific profile (e.g. sms:twilio-prod) |
auto | smart routing picks channel and vendor |
test:header | nothing — test keys only, see Testing |
A profile is one vendor's credentials (Twilio, Resend, SMTP, WhatsApp Cloud, Telegram…), configured per business and per mode in Console → Providers. Switching vendors is a console change, not a code change.
Routing
Optional rules in Console → Routing send each code through the cheapest, fastest or a weighted provider, and fail over to the next one when a vendor is down. Without rules, the channel default is used.
Protection
Built in, configured per business in the console:
- Firewall — allow/deny by IP, country, user agent, phone prefix, carrier, email domain.
- Send limits — caps per destination, IP, channel or prefix; exceeding one
is
429withRetry-After. - Attempts — five wrong codes burn a verification.
Every request carries an X-Request-ID (the trace_id) that finds it in the
console's audit and verification logs.