Skip to main content
Server API keys (sk_live_...) authenticate server-to-server calls to the ThunderPhone API. Keys live under Organization → Keys.
Server keys are secrets. Never ship one in client-side code — for browsers, use origin-locked publishable keys (pk_live_...) instead.
1

Open the Keys tab

Go to Organization → Keys and click Create key.
2

Name it

Pick a name that says where the key will live — like “Production backend”. Names are labels only; they don’t affect access.
3

Create the key

Click Create key in the dialog. This generates the secret.
4

Copy it now

The full secret is shown exactly once. Copy it into your secret manager — after you leave, only the prefix remains visible.

​
Use it

The key is bound to this organization, so requests need no org id — just the Bearer header:
From here, the API quickstart takes you to your first call in three more requests.

​
Rotate and revoke

Create a new key, move your services over, then delete the old one from the same tab — the list shows each key’s prefix and name so you can tell them apart. Manage keys programmatically via the developer API keys reference.
Server API keys are machine credentials and are exempt from your organization’s Require passkeys policy — that setting checks human sign-ins, not sk_live_... keys. Because of that, rotating and revoking keys promptly here is your main control over standing API access; if passkeys are required, the security policy panel shows how many active keys are currently exempt.
Ask the in-app copilot to “create an API key” and it will walk you through this flow, spotlighting each control live.

​
Next steps

API quickstart

Agent, number, webhook, first call — four REST calls.

Authentication reference

How Bearer auth and org binding work.