Integration security
A key identifies an organization
Section titled “A key identifies an organization”Read authentication for the request format and API keys for creation and permissions. This page covers key protection and responding to exposure in an SMS v2 integration.
V2 exclusively accepts organization bf_sms_ keys. Bearer authentication determines the organization; it does not depend on a client-supplied selection header.
Retrieved resources must belong to that organization. A technical key can remain valid after its creator leaves, until explicitly revoked. Include keys in your offboarding and access review procedures.
Grant the permissions you need
Section titled “Grant the permissions you need”Scroll horizontally if needed. Keyboard: Tab, then the left and right arrow keys.
| Permission | Use |
|---|---|
sms.send | Send a message immediately |
sms.schedule | Schedule a message or batch |
delivery.read | Read messages, batches and statuses |
balance.read | Retrieve the balance |
contacts.manage | Create or update a contact |
Create separate keys for separate integrations. Grant only the permissions in use.
Store the secret
Section titled “Store the secret”The complete secret is displayed once when the key is created in Cloud. Place it in your service’s secret manager or protected environment variables. Do not include it in a repository, URL, distributed frontend, screenshot or shared collection.
The portal does not store your keys or offer production requests in the browser. Do not paste a key into documentation search.
Rotate and revoke
Section titled “Rotate and revoke”- Create a new key with the necessary permissions.
- Update your application’s protected configuration.
- Verify authorized normal calls.
- Revoke the previous key in Cloud.
Revocation blocks future calls using the key. It does not cancel previously accepted messages or existing schedules. Retain your idempotency keys through rotation.
If a key is exposed
Section titled “If a key is exposed”Revoke the affected key, replace it and examine your integration logs. Contact support without transmitting the exposed secret. Provide the key identifier or public prefix when available.
Contractual availability, retention and compliance commitments must be confirmed with BEFIANA; this technical documentation does not replace them.