Authentication

Bearer token

Every request includes:

Authorization: Bearer osis_…

Store the secret as an environment variable on your server:

COMMS_API_KEY=osis_xxxxxxxxxxxxxxxxx

Never put Messages API keys in browser code, mobile apps, CI logs, or public git history. Treat them like production database passwords.

Open Messages API

Create key

Name the key after the service that will hold it (Production worker, Staging).

Pick scopes

Defaults (send + read) cover most backends. Add webhooks only if that process registers endpoints.

Copy once

The full secret is shown a single time. If you lose it, rotate.

Scope	Grants
`comms_send`	`POST /api/v1/comms/messages`
`comms_read`	List messages, conversations, contacts, delivery events
`comms_webhooks`	List and create webhook endpoints

Missing scope response:

{ "error": "missing comms_send scope" }

HTTP 403.

Yes	No
Send and receive on the line from your backend	Change org billing or plan
Register webhooks for message events	Manage dashboard users
Power workers, queues, and CRON jobs	Replace a signed-in dashboard session

AI model calls from your code will use this same key style later — still use the platform, not administer the platform.

From the Messages API page:

Authenticated callers share per-org buckets. See Errors & rate limits.