Authentication

Public API: Authorization: Bearer sms_test_… or sms_live_…. The raw secret is stored as SHA-256 only after creation.

Console: email/password session cookie taysend_session (httpOnly). The browser client always sends credentials: 'include'. Do not copy that cookie into localStorage.

List messages
curl "$API_URL/v1/messages?limit=20" \
  -H "Authorization: Bearer sms_test_..."