API Key validation (optional)
You can optionally validate the Beem API Key on inbound callback requests. This is separate from authenticating outbound API calls to other Beem products, which use Basic Auth (API Key and Secret) or an access token.
API Key and Secret
Generate credentials from the Beem dashboard:
- Navigate to SMS → API Setup
- Click Generate API Key and Secret
Use these credentials to verify that incoming callback requests originate from Beem.
The API Secret is only shown once when generated. Store it securely — you cannot retrieve it again from the dashboard.
Callback endpoint security
Your callback URL is registered on your Two-Way number in the Beem portal. To keep inbound message handling secure:
- Use HTTPS only — do not expose callback endpoints over plain HTTP
- Validate the API Key (or other auth token) on every request before processing the payload
- Respond with an error status if authentication fails
- Do not log or expose subscriber message content in unsecured systems
Best practices
- Keep your API Secret out of client-side code and version control
- Process callbacks idempotently using
transaction_id to avoid duplicate handling
- Return responses quickly — long processing should happen asynchronously after acknowledging the callback
- Monitor failed callbacks and alert on repeated authentication failures
