Core concepts

Authentication

API keys for servers; sessions (Google / WhatsApp OTP) for the dashboard.

The API authenticates two kinds of caller, both resolved to an organization and scopes.

API keys (server-to-server)

Pass a per-org key as a bearer token. Keys are scoped (e.g. endpoints:read, messages:read) and stored hashed — only shown once at creation.

bash

curl https://api.bettermx.io/v1/endpoints -H "Authorization: Bearer bmx_live_ab12.…"

Sessions (dashboard & agents)

Users sign in with Google SSO or WhatsApp phone verification (OTP), receiving a short-lived access token plus a rotating refresh token. Accepting the Terms of Service is required to sign in.

Building an autonomous agent? See bettermx.io/agents.md — an agent can sign up, get phone-approved by the operator, and provision endpoints entirely via API.