Authentication

MorisBox exposes two key types according to account type.

Account	Key prefix	Usage
Partner	sk_… (excluding sk_dev_)	Complete Partner API (/messages, bots, templates, and more)
Developer	sk_dev_…	Developer API only (/dev/*) - MorisBox templates

Do not use end-user JWTs in a partner or developer backend.

---

Common header

Authorization: Bearer <api_key>
Content-Type: application/json

Developer keys also accept X-Api-Key: sk_dev_….

---

Partner keys

Property	Description
Format	Opaque (sk_…)
Storage	Server-side hash; the secret is displayed only once
Scopes	send, read, templates, full, and others
IP allowlist	Optional, per key

Create a key (Partner Hub)

1. Sign in to Partner Hub
2. Open Administration → API Keys → Create
3. Copy the secret immediately

Programmatic creation

POST /api/v1/settings/api-keys
Authorization: Bearer <existing_key>

{
  "name": "Backend production",
  "scopes": "send"
}

Partner Hub sign-in (UI)

Endpoint	Purpose
POST /api/v1/auth/partner/login	Login and password → session key
POST /api/v1/auth/partner/logout	Revoke the session key
Onboarding	Request a partner account

Server integrations should use dedicated API keys, not the UI session.

---

Developer keys

See the complete guide: Developer Accounts.

Endpoint	Purpose
POST /api/v1/auth/developer/register	Create an account and first key
POST /api/v1/auth/developer/login	Dashboard session
GET/POST /api/v1/dev/api-keys	Manage keys
DELETE /api/v1/dev/api-keys/{id}	Revoke a key

Developers do not use the partner /api/v1/messages endpoint. They use /api/v1/dev/messages with template_code.

---

Security checklist

• Use HTTPS in production and the public sandbox
• Rotate keys after a leak
• Apply least-privilege scopes
• Never embed a key in a public mobile app
• Verify webhook signatures (Webhooks)

---

Unauthorized responses

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or expired API key."
  }
}

Statuses: 401 for an invalid key, or 403 for a disallowed scope, IP, or role.