---
title: "Authentication & API Keys"
source: https://sumgenius.ai/docs/api-authentication
generated: 2026-07-30
---

# Authentication & API Keys

One kind of key opens everything: the [REST API](https://sumgenius.ai/docs/rest-api), the [Send API](https://sumgenius.ai/docs/send-api), and webhook management. This page covers the key format, the headers, and managing keys in the portal.

Webhook & API Add-on · $29/month · Requires Creator+ plan

### API keys

Keys are created in the portal under **Integrations → Webhook & Send API**. A key is a 53-character string: the prefix `sgwh_` followed by 48 hex characters.

- named keysup to 10 active Create a key per system ("Production backend", "Zapier", "Partner CRM") so each can be rotated or revoked without touching the others.
- preview The portal lists each key by name with its last 8 characters, plus when it was created, last rotated, and last used.
- storage We store keys hashed for authentication; the account owner can re-reveal a key's full value from the portal.

> **Warning**
>
> A key is a server-side credential. Never ship it in a browser, mobile app, or public repo. The REST and Send APIs have no CORS on purpose: they are not callable from front-end code.

**Key format**

```
sgwh_................................................
└─┬─┘ └──────────────────── 48 hex ────────────────────┘
prefix
```

**Portal key list**

```
Production backend   sgwh_…c1d94ab2   last used 2m ago
Zapier               sgwh_…88f0e3aa   last used 3d ago
Partner CRM          sgwh_…41b7cc09   never used
```

### Sending the key

Send the key on every request as any one of three headers. All three are equivalent on every endpoint of both APIs; `X-SumGenius-Api-Key` is preferred.

- X-SumGenius-Api-Keypreferred
- X-API-Key
- Authorization: Bearer

Auth errors

- 401 unauthorized No key sent.
- 401 invalid_api_key Key not recognized, revoked, or rotated away.
- 403 addon_inactive Key is valid but the Webhook & API Add-on is not active on the account.

**The three headers**

```
# preferred
curl https://sumgenius.ai/api/v1/account \
  -H "X-SumGenius-Api-Key: sgwh_your_api_key_here"

# equivalent
curl https://sumgenius.ai/api/v1/account \
  -H "X-API-Key: sgwh_your_api_key_here"

curl https://sumgenius.ai/api/v1/account \
  -H "Authorization: Bearer sgwh_your_api_key_here"
```

**Error 401**

```
{
  "error": {
    "code": "invalid_api_key",
    "message": "API key not recognized."
  }
}
```

### Create, rotate, revoke

- Create Name it after the system that will hold it. The full key is shown on creation; copy it into that system's secret store.
- Rotate Replaces the key's secret in place: same name, same entry, new value. The old value stops working immediately, so update the consuming system in the same sitting. If a key may be exposed, rotate it first and investigate second.
- Revoke Kills the key immediately and permanently. Revoked keys cannot be restored; create a new one instead.

> **Tip**
>
> Webhook **signing secrets** are separate credentials, one per endpoint, used to verify deliveries we send to you. Keys authenticate you to us; secrets authenticate us to you. Secret rotation has a 24-hour grace window; see [Verifying signatures](https://sumgenius.ai/docs/receiving-webhooks#verify).

**Rotation checklist**

```
1. Portal → Integrations → Webhook & Send API
2. Rotate the key for the affected system
3. Copy the new value into that system's secrets
4. Confirm its next API call returns 200
5. Old value is already dead, nothing to clean up
```