Create API keys with the right permissions

Live vs test keys, scopes, and why the secret is shown only once.

For Developers and WordPress installers

1. 1

   Open App connections

   Dashboard → App connections (or Developers → API Keys). Create a key per environment — production vs staging — instead of sharing one secret everywhere.

2. 2

   Grant the minimum scopes

   sms.send for send and OTP. sms.read for logs. wallet.read for balance. contacts.read / contacts.write for list sync. WordPress needs sms.send and usually sender_ids.read.

3. 3

   Store the full secret

   Copy the ~56-character key immediately. Later the UI only shows a prefix. Put it in a server environment variable — never in frontend JavaScript or a public WordPress page.

4. 4

   Rotate if leaked

   Revoke the old key and create a new one. Update WordPress Settings or your app config in the same change.