You are responsible for every message sent through your account, so treat API access with care.
Call the API from your server
Never call the API directly from a browser (JavaScript) or a mobile app. Anything shipped to a client exposes your API key to everyone who uses it.
Instead, add an endpoint on your own backend that your website or app calls, and have that endpoint call the API.
Protect public forms
If a public form triggers SMS (sign-up codes, contact forms, call-me-back requests), add spam protection such as a CAPTCHA and per-user or per-IP limits on your side. Otherwise anyone can use your form to send messages at your expense.
For phone verification, also limit how many codes a user can request and how many guesses they can make. See Verify.
Manage keys
- Create a separate API key for each integration, so you can disable one without affecting the others.
- Store keys in environment variables or a secrets manager, never in source control.
- If a key leaks, disable it on the API Keys page in touchSMS and create a new one.
Verify webhooks
Webhooks are signed with your account’s webhook secret. Check the signature before trusting a payload. See Signature verification.
Inbound MMS media URLs need no authentication to download, so treat them as secrets. See Inbound MMS media.