Skip to main content
API keys allow programmatic access to the Trackly SMS API. Create, manage, and revoke keys from the dashboard.

​
Who Can Manage Keys

Only Owners can create, view, and delete API keys. Members and Viewers cannot access API key management.

​
Creating an API Key

  1. Go to Settings > API Keys
  2. Click Create API Key
  3. Enter a name (e.g., “Production API”, “Development”)
  4. Choose sandbox mode and the key’s sending controls. For an assistant, enable Require send approval, select allowed sending lists, and set a daily live-send cap
  5. Click Create
  6. Copy the key immediately into your application’s or MCP client’s private credential settings — it won’t be shown again
API keys are shown only once at creation. Keep them out of assistant conversations, tool arguments, shared configuration examples, and source control. If lost, create a replacement and update the private client configuration.

​
Key Properties

Enable Require send approval when creating or editing a key to require a person to review each SMS hold in Settings > Send Approvals. The key uses pending sends for single or bulk SMS. Direct SMS/raw SMS, email, OTP, and send-enabling operations are blocked. Email and OTP have no approval workflow; Voice Calls is a separate product. Reads, stop, and unsubscribe remain available. The key API uses requireSendConfirmation; Who Am I reports api_key.send_policy.require_confirmation. Rotation preserves the setting. Changing it revokes other active, grace-period, and paused credentials in the same rotation family.

​
Connect an AI assistant

Use a separate sandbox key with confirmation required for initial setup. Follow Connect an AI assistant to configure a verified MCP connection and inspect its account and mode. The assistant holds a proposed SMS; a person reviews it in Settings → Send Approvals before execution. These settings do not establish recipient consent, provision a sender, or guarantee delivery. See the approved-send walkthrough for the complete flow and handling uncertain outcomes.

​
Using API Keys

Include the key in the X-Api-Key header:
See API Authentication for details.

​
Pause and resume

An owner can pause a key in Settings → API Keys. The assistant can pause its own key through trackly_pause_key, optionally supplying a reason. Paused credentials stop authenticating and cannot resume themselves. To resume, an owner reviews the current key state in Trackly and selects Resume. If the key changed after the page was loaded, refresh and review it again. A rotated key keeps its original grace deadline; resuming does not extend it.

​
Revoking Keys

To revoke (delete) a key:
  1. Go to Settings > API Keys
  2. Find the key
  3. Click Delete
  4. Confirm deletion
Revocation is immediate. Any systems using this key will immediately fail with 401 errors.

​
Key Rotation

Best practice: Rotate keys periodically.
  1. Create a new key
  2. Update your systems to use the new key
  3. Verify the new key works
  4. Delete the old key

​
Multiple Keys

Changing an API key’s allowed lists or daily send cap immediately revokes other still-valid keys from the same rotation chain, including keys in a grace window. Move integrations to the key you are editing before changing its send policy. Renaming a key or saving an equivalent policy preserves the existing grace window. Rotated keys share the day’s send usage, so rotation does not reset the allowance. You can have multiple active keys: This allows:
  • Rotating one without affecting others
  • Different access for different systems
  • Easier tracking of which system uses which key

​
Discord Linking

API keys are also used to link Discord accounts:
The key verifies your identity and links Discord to your account.

​
Security Best Practices

Use environment variables or secret managers. Add keys to .gitignore.
Different keys for dev, staging, production. Easier to rotate and track.
Check the “Last Used” column. If a key hasn’t been used in months, consider revoking.
When team members with key access leave, rotate keys as a precaution.

​
Troubleshooting

  • Check the key is correct (no extra spaces)
  • Verify the key hasn’t been revoked
  • Ensure you’re using X-Api-Key header
Keys can’t be recovered. Create a new one and update your systems.
Only Owners can manage API keys. Ask an Owner for a key or to upgrade your role.

​
Next Steps

API Reference

Start making API calls

Billing

View usage and costs