Authentication

API keys, permissions and allowed IP addresses.

Send your key on every request as a Bearer token:

Authorization: Bearer gr_live_…

Requests sent here are real and charged like any other.

Keys

Make keys in the app under Developer → API keys (Owner and Admin only). A key is shown once; we keep only a fingerprint of it, so nobody at GetReply can show it again. If you lose a key, switch it off and make a new one. Each new key sends a security email to the account owner.

Permissions

Permission	Can do
Full	Everything, including templates and webhooks
Send only	Send messages and campaigns, manage contacts, read everything
Read only	Read only

Use Send only for your website or app; keep Full for admin tools.

Allowed IP addresses

When you make a key you can list the addresses it may be used from, one per line. Requests from any other address answer ip_not_allowed. We use the address your request really came from; headers such as X-Forwarded-For that you send are ignored.

When a key stops working

• Switched off in the app: it never comes back. Make a new one.
• Off · plan ended: the API needs Pro. The key comes back on by itself when you are on Pro again.
• Too many wrong keys from one address block that address for a while. See Limits.