Authentication
Public API: Authorization: Bearer sms_test_… or sms_live_…. The raw secret is stored as SHA-256 only after creation.
Console: email/password session cookie taysend_session (httpOnly). The browser client always sends credentials: 'include'. Do not copy that cookie into localStorage.
List messages
curl "$API_URL/v1/messages?limit=20" \
-H "Authorization: Bearer sms_test_..."