How to create, use, and revoke an EMAK Telecom API key.
Every request to the EMAK Telecom API is authenticated with an API key that belongs to your account. There is no separate login step and no token exchange — you send the key on each request.
Create an API key
API keys are created in the app, not through the API.
- Sign in as a user with the Admin role on your account.
- Go to Settings → Business → API Keys.
- Select Create API Key, give the key a name that says where it will be used (for example
billing-syncorzapier), and confirm.
The key is shown once, at the moment it is created. Copy it then and store it somewhere safe — it cannot be retrieved again afterwards. The list view shows only the first and last few characters so you can tell your keys apart.
If you do not see the API Keys page, your user does not have the Admin role. Ask an administrator on your account to create the key for you.
Use your key
Send the key in the Authorization header as a bearer token:
curl https://api.emaktalk.com/api/v1/extensions \
-H "Authorization: Bearer sk_your_key_here"Keys always begin with sk_.
What a key can access
An API key is bound to the account that created it and carries Admin-level access within that account only.
- It can read and write the resources of your own account.
- It cannot see or touch any other account on the platform. This is enforced on the server for every request; there is no parameter that widens it.
- Platform-level operations — creating accounts, changing another account's configuration — are not available to API keys and return
403.
Keys do not expire. They remain valid until you revoke them.
Revoke a key
Revoke a key from the same Settings → Business → API Keys page. Revocation takes effect immediately: the very next request made with that key is rejected with 401.
Revoke a key as soon as you suspect it has been exposed, and whenever the integration that used it is retired.
Authentication errors
| Status | Meaning | What to do |
|---|---|---|
401 | The Authorization header is missing, malformed, or the key is unknown or revoked. The body is {"authorized": false, "method": "api_key", "message": "Invalid API key supplied."}. | Check the header format and that the key has not been revoked. |
403 | The key authenticated, but the operation is not permitted for it — either it requires platform-level access, or it targets a resource that does not belong to your account. | Confirm the resource belongs to your account. Retrying will not help. |
Keeping keys safe
Treat an API key like a password.
- Use it only from your own servers. Never embed it in a browser application, a mobile app, or any client you distribute — anyone who can read the code can read the key.
- Keep it out of source control. Load it from an environment variable or a secrets manager.
- Use a separate key per integration, so you can revoke one without interrupting the others.