Authentication
API keys for your servers, ephemeral keys for browsers.
Every request carries Authorization: Bearer <key>. Two kinds of keys exist, for two places.
| Where your code runs | Key | Lifetime | Can do |
|---|---|---|---|
| Your server | API key 06l_… | until revoked | everything |
| A browser (your softphone) | Ephemeral key ek_… | 15 minutes | list lines, open WebRTC sessions, place, answer and hang up calls |
An API key must never reach a browser. Ephemeral keys exist so it never has to.
API keys
Create and revoke them in the dashboard. A key belongs to one company and acts on all of its lines. Everything it does
is recorded as done by that key: created_by on every SMS and call reads { "type": "api_key", "id": "key_…" }.
Browsers
- Your server calls
POST /v1/ephemeral-keyswith its API key, optionally restricted to one line. - It hands the response to the browser: the key, its expiry, and the STUN and TURN servers WebRTC needs.
- The browser uses the key for 15 minutes, then asks your server for a new one. The SDK does this by itself.
curl -X POST https://api.06line.com/v1/ephemeral-keys \
-H "Authorization: Bearer $SIXLINE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"line_id": "line_01jbq5a3x9e2k7m4t6v8r0c1yb"}'A WebRTC session or a call that is already open keeps going when the key expires: a three-hour call is never cut by it.
Failures
| Status | code | Cause |
|---|---|---|
| 401 | unauthorized | Missing, unknown, revoked or expired key |
| 403 | forbidden | The key cannot do this: an ephemeral key sending an SMS, or reaching a line it is not restricted to |
| 429 | rate_limited | Too many requests; retry after retry_after_ms |