> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beem.africa/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Validate callback requests using your Beem API Key.

## API Key validation (optional)

You can optionally validate the Beem API Key on inbound callback requests. This is **separate** from authenticating outbound API calls to other Beem products, which use Basic Auth (API Key and Secret) or an access token.

***

## API Key and Secret

Generate credentials from the Beem dashboard:

1. Navigate to **SMS** → **API Setup**
2. Click **Generate API Key and Secret**

Use these credentials to verify that incoming callback requests originate from Beem.

<Warning>
  The API Secret is only shown once when generated. Store it securely — you cannot retrieve it again from the dashboard.
</Warning>

***

## Callback endpoint security

Your callback URL is registered on your Two-Way number in the Beem portal. To keep inbound message handling secure:

* Use **HTTPS** only — do not expose callback endpoints over plain HTTP
* Validate the API Key (or other auth token) on every request before processing the payload
* Respond with an error status if authentication fails
* Do not log or expose subscriber message content in unsecured systems

***

## Best practices

* Keep your API Secret out of client-side code and version control
* Process callbacks idempotently using `transaction_id` to avoid duplicate handling
* Return responses quickly — long processing should happen asynchronously after acknowledging the callback
* Monitor failed callbacks and alert on repeated authentication failures