Find the right credential for each CommPeak API, create a Portal API key, and protect your keys.
CommPeak APIs use three kinds of credentials. The Portal API key covers most APIs, while the TextPeak APIs and the PBX Stats API have credentials of their own. This page shows you how to get each one, which header to send it in, and how to protect it.
Which credential to use
| API | Credential | Header |
|---|---|---|
| Portal API | Portal API key | Authorization: <API_KEY> |
| Dialer API, PBX API, and Lookup API | Portal API key with Full access (all services) | Authorization: <API_KEY> |
| TextPeak API | TextPeak API key | Authorization: <token> |
| TextPeak Streams API | Stream token or OTP token | Authorization: <token> |
| PBX Stats API (deprecated) | PBX Stats API key | X-API-KEY: <API_KEY> |
Send every credential as the raw header value, without a Bearer prefix.
Creating a Portal API key
The Portal API key authenticates the Portal, Dialer, PBX, and Lookup APIs.
Log in to the CommPeak Portal
Log in to the CommPeak Portal.
Open API Keys
Expand Settings in the main menu, open the API Access tab, and select API Keys.
Add a key
Click Add API key.
Name the key
Enter a Name that helps you recognize the key later.
Set the SMS stream and SIP account
Optional: select a Default SMS Stream and a SIP Account for Calls. Only JWT-enabled SIP accounts can be selected, and calls placed with the key are originated as that account.
Keep full access on
Under Access, keep Full access (all services) turned on to use the key with the Dialer API, PBX API, and Lookup API as well as the Portal API. It is on by default. Without it, Dialer, PBX, and Lookup requests return 403.
Set read-only access
Optional: turn on Read-only (Portal API only) if the key only needs to view Portal API data. A read-only key cannot create, change, or delete anything in the Portal API, but it can still place calls, and it does not limit other services enabled for the key.
Restrict the IP addresses
Optional: under IP ACL, enter the public IP address of each server that will send requests, in CIDR format, for example 203.0.113.10/32, and click Add. Leave it empty to allow requests from any IP address.
Create the key
Click Create, then confirm with your account password.
Copy the key
Click the eye icon next to the new key, confirm with your password again, and copy the key.
Send the key in the Authorization header of every request to the Portal, Dialer, PBX, and Lookup APIs as the raw value, without a Bearer prefix: Authorization: <API_KEY>.
For editing and deleting keys, see Managing Portal API Keys.
NOTELegacy tokens on the Lookup API Service tab of the CommPeak Portal are deprecated. Create an API key on the API Keys tab instead.
Getting TextPeak tokens
The TextPeak APIs use three token types that are not interchangeable:
- TextPeak API key: manages streams, senders, domains, webhooks, and other resources through the TextPeak API. Create it on the API Keys page in TextPeak.
- Stream token: sends messages from one stream through the TextPeak Streams API. Get it with your API key from the Get stream token endpoint.
- OTP token: the stream token of a stream set up for one-time passwords (OTP). It is the only token the OTP endpoints accept.
Send each token as the raw header value, Authorization: <token>, without a Bearer prefix. For details, see the TextPeak API overview.
Getting a PBX Stats API key (deprecated)
The PBX Stats API is deprecated and is not served through api.commpeak.com. Existing integrations keep using its own API key, sent in the X-API-KEY header. To create one, see Getting PBX Stats API Keys and Documentation.
Endpoints you call on your own subdomain
Two Dialer features are not served through api.commpeak.com and do not use your Portal API key:
- Dispatch Automation endpoints run on
https://{sub_domain}.td.commpeak.com/integrations/adapters/hook. The adapter ID in the path authenticates the request. - Click2Call runs on
https://{sub_domain}.td.commpeak.com/integrations/c2c. The Click2Call ID and the caller's IP address are checked against the setup's allowed IP list.
If you send one of these requests to the api.commpeak.com path, you get 404 with a url field that holds the correct address.
Securing your credentials
Anyone who has your API key can use the API on your behalf. To protect your account:
- Store keys on your server in environment variables or a secrets manager, never in browser or mobile app code.
- Restrict each key to the IP addresses that send requests.
- Turn off Full access (all services) for keys that only need the Portal API, and turn on Read-only (Portal API only) for keys that only read Portal API data.
- Create separate keys for each integration and each environment, such as testing and production, so you can revoke one without affecting the others.
- Delete keys you no longer use, or that may have been exposed, and replace them.
IMPORTANTDeleting an API key cuts off every application that uses it at once. Create the replacement key and update your integrations before you delete the old one.
Next steps
- Make your first request with your new key in Getting Started with CommPeak APIs.
- If a request is rejected, see Requests, Errors, and Rate Limits.