Developers
The inbox your software can sit in
Same app as the portal, different auth: API keys, not cookies. Keys are shown once, scoped, and optionally fenced to a number allowlist — safe to hand to software or a BE AI agent (the product AI on the same 04, or your own integration).
Keys
API keys let software send, read, and subscribe to the same inbox the desk uses — without a portal cookie. A company admin mints them in Settings. The secret is shown once and stored hashed.
Format besms_live_<prefix>_<secret>
- Stored hashed; secret shown once
- Scopes for send, read, conversations, AI, webhooks
- Optional number allowlist — fence a key to specific 04s
- Managed in the portal at Settings → API keys (company admin)
Webhooks & people forwards
Push endpoints are for systems. Forwards are for people. Both hang off the same inbound path, so a message that lands in the inbox can also notify software or a human copy.
- HMAC-signed webhooks for message, AI, case, and survey events
- Inbound forwarding to email and/or SMS for humans (Settings → Inbound Forwarding)
- Systems subscribe; people get a copy — they are not the same tool
MCP
Hosted assistants can use the same inbox tools over MCP — send, read, and work the conversations the desk already sees. Auth is the API key or an OAuth token. Sessions hold no business state, so a deploy that changes tools just asks the client to re-initialise.
API docs
The full contract — endpoints, scopes, webhooks, errors, quickstart — is in the portal. Sign in to read it.