# Developer API page (/guides/developer-api)

The **Developer API** page is where your organisation manages the keys its own systems use to send SMS. You need to be an organisation **Admin**. Go to **Management → Developer API**.

For how to use the API itself, see the [Developer API docs](/api).

![Developer API page — API keys and recent API messages](</_next/static/media/dev-01.0v8-7yoymn0s6.png>)

## Create a key [#create-a-key]

1. Click **Create key**.
2. Give it a **Name** (e.g. *Website checkout*).
3. Choose the **Environment**:
   - **Test (sandbox)** — for building and testing. Nothing is really sent and no units are used.
   - **Live** — sends real SMS and uses units.
4. Choose **Permissions**: Send SMS, Read message status, Read wallet balance. Only give what that system needs.
5. Optionally add a **Webhook URL** (where delivery reports are sent) and an **Expires** date.
6. Click **Create key**.

**Copy the key and the webhook signing secret now** — they are shown only once. Give them to your developer through a secure channel, never by plain email or chat.

![Key created — copy the key and webhook secret](</_next/static/media/dev-02.3cy6rqtqgqmfa.png>)

## Webhooks [#webhooks]

In the **Webhook** column:

- ✏️ **Edit** — set or change where delivery reports are sent. Live keys need an `https` address.
- ✈️ **Test** — sends a sample signed delivery report right away and tells you whether your server accepted it.
- **Get secret / New secret** — creates the signing secret your developer uses to check that reports really come from CloudMetis. **New secret** replaces the old one immediately.

## Roll a key [#roll-a-key]

Use **Roll** to replace a key — routinely, or immediately if it may have leaked. The new key keeps the same settings and webhook secret. Choose when the old key stops working: **Immediately**, **In 1 hour**, **In 24 hours** (recommended, gives time to update your systems) or **In 7 days**.

## Revoke a key [#revoke-a-key]

**Revoke** stops a key permanently and immediately. Any system still using it stops working.

## Recent API messages [#recent-api-messages]

The table at the bottom lists messages sent through the API, with their status and the key used. Test-key messages have a **sandbox** badge. All API messages also appear in [Delivery reports](./sms/delivery-reports.mdx).