API keys shown once
sms_test_ and sms_live_ keys are displayed at creation only. Store them in your secret manager — we cannot show them again. Rotate compromised keys from the dashboard.
Security
Security — keys, OTP, sessions, and ledger
SMS infrastructure handles money and identity. Taysend applies practical controls — hashed OTP codes, one-time API key display, httpOnly sessions, and a prepaid ledger you can reconcile — without claiming certifications we do not hold.
Product
What we implement
OTP hashed at rest
Plaintext verification codes are never persisted. POST /v1/verify/check compares against a hash. Never log codes in your application logs.
httpOnly session cookies
Dashboard sessions use httpOnly cookies — not localStorage tokens that XSS can read. Sign out clears the server-side session.
Prepaid ledger
Every send reserves wallet funds before dispatch. Manual credits require amount, reason, and confirmation — not a silent balance edit.
Signed webhooks
Webhook payloads include t= (timestamp) and v1= (HMAC signature). Verify before acting on delivery or wallet events.
TEST isolation
sms_test_ keys cannot send LIVE traffic. Simulated numbers have known outcomes so you can test without touching real handsets.
Idempotent sends
Idempotency-Key prevents duplicate charges from network retries. Same key and body returns the original response.
Enterprise audit
Org RBAC, impersonation banners, and audit exports for teams that need operational accountability — see /enterprise.
Your side
Your responsibilities
- Keep sms_live_ keys on the server only — never in browser code or public repos.
- Verify webhook signatures before updating order or account state.
- Use HTTPS for all API calls to https://api.taysend.com.
- Handle OTP check outcomes in your UI — do not expose whether a phone number exists.
- Review the privacy policy for data handling.
Explore
Related
Each page answers a different question. They are not copies of this one.
FAQ
Straight answers
If something here is product behaviour, it matches the dashboard and the API.
01Does Taysend hold ISO 27001 or SOC 2 certification?+
We do not claim certifications we have not earned. This page describes concrete product behaviour — key handling, OTP hashing, sessions, and ledger rules.
02Where should I store my API key?+
Environment variables or a secret manager on your server. Never embed sms_live_ keys in client-side JavaScript or mobile app binaries.
03What happens if my key leaks?+
Revoke the key in the dashboard and create a new one. Monitor wallet activity and webhook events for unexpected sends.
04How are OTP brute-force attempts handled?+
Server-side cooldown, max verification attempts, and per-phone send limits. POST /v1/verify/check returns explicit outcomes including max attempts.
Questions