# API key

> An API key is the secret credential that identifies an account to the SMS API; it is sent as a bearer token, scoped to what it may do, and should be created per system and revoked when exposed.

Keys replace passwords for software. A good implementation shows the key once at creation, stores only a hash, lets you scope it (send only, read only) and restrict it to an IP allowlist, and lets you revoke it instantly. One key per integration means a leak affects one system and a rotation is painless.

Keys belong in environment variables or a secrets manager, never in client-side code or a repository.

At SMSMeteor: keys are created in the panel with `send` and `read` scopes and an optional IP allowlist; `sk_test_` keys validate and price without sending.

Related terms: [Bearer token](https://smsmeteor.com/glossary/bearer-token), [Test key (sandbox)](https://smsmeteor.com/glossary/test-key), [REST API (SMS)](https://smsmeteor.com/glossary/rest-api)

---
Source: https://smsmeteor.com/glossary/api-key (HTML). Generated by SMSMeteor from the same data as the page. Summary of the whole site: https://smsmeteor.com/llms.txt