Authentication & API Keys

One kind of key opens everything: the REST API, the Send API, and webhook management. This page covers the key format, the headers, and managing keys in the portal.

Webhook & API Add-on · $29/month · Requires Creator+ plan

API keys

Keys are created in the portal under Integrations → Webhook & Send API. A key is a 53-character string: the prefix sgwh_ followed by 48 hex characters.

named keysup to 10 active

Create a key per system ("Production backend", "Zapier", "Partner CRM") so each can be rotated or revoked without touching the others.
preview

The portal lists each key by name with its last 8 characters, plus when it was created, last rotated, and last used.
storage

We store keys hashed for authentication; the account owner can re-reveal a key's full value from the portal.

⚠️

A key is a server-side credential. Never ship it in a browser, mobile app, or public repo. The REST and Send APIs have no CORS on purpose: they are not callable from front-end code.

Key format

sgwh_................................................
└─┬─┘ └──────────────────── 48 hex ────────────────────┘
prefix

Portal key list

Production backend   sgwh_…c1d94ab2   last used 2m ago
Zapier               sgwh_…88f0e3aa   last used 3d ago
Partner CRM          sgwh_…41b7cc09   never used

Sending the key

Send the key on every request as any one of three headers. All three are equivalent on every endpoint of both APIs; X-SumGenius-Api-Key is preferred.

X-SumGenius-Api-Keypreferred
X-API-Key
Authorization: Bearer

Auth errors

401 unauthorized

No key sent.
401 invalid_api_key

Key not recognized, revoked, or rotated away.
403 addon_inactive

Key is valid but the Webhook & API Add-on is not active on the account.

The three headers

# preferred
curl https://sumgenius.ai/api/v1/account \
  -H "X-SumGenius-Api-Key: sgwh_your_api_key_here"

# equivalent
curl https://sumgenius.ai/api/v1/account \
  -H "X-API-Key: sgwh_your_api_key_here"

curl https://sumgenius.ai/api/v1/account \
  -H "Authorization: Bearer sgwh_your_api_key_here"

Error 401

{
  "error": {
    "code": "invalid_api_key",
    "message": "API key not recognized."
  }
}

Create, rotate, revoke

Create

Name it after the system that will hold it. The full key is shown on creation; copy it into that system's secret store.
Rotate

Replaces the key's secret in place: same name, same entry, new value. The old value stops working immediately, so update the consuming system in the same sitting. If a key may be exposed, rotate it first and investigate second.
Revoke

Kills the key immediately and permanently. Revoked keys cannot be restored; create a new one instead.

💡

Webhook signing secrets are separate credentials, one per endpoint, used to verify deliveries we send to you. Keys authenticate you to us; secrets authenticate us to you. Secret rotation has a 24-hour grace window; see Verifying signatures.

Rotation checklist

1. Portal → Integrations → Webhook & Send API
2. Rotate the key for the affected system
3. Copy the new value into that system's secrets
4. Confirm its next API call returns 200
5. Old value is already dead, nothing to clean up