Developers & API

One API for messaging, verification & delivery.

Send over WhatsApp, SMS and email, run OTP & verification with automatic fallback, manage contacts and campaigns, publish a catalogue and take payments — all from one REST API, secured with scoped keys and signed event webhooks. No separate developer account: your keys live in the Truspond app you already use.

POST truspond.com / v1 / messages
# send a WhatsApp message
curl https://truspond.com/v1/messages \
  -H "Authorization: Bearer skn_live_…" \
  -d '{
    "channel": "whatsapp",
    "to": "+91 98765 43210",
    "template": "order_update",
    "vars": { "1": "SO-4821" }
  }'

# 202 Accepted
{
  "id": "msg_7Qf3…",
  "channel": "whatsapp",
  "status": "queued"
}
Why build on Truspond

Three rails, one contract, no glue code.

One API, every channel

WhatsApp, SMS and email behind a single endpoint and one set of docs. Switch or fall back between channels without re-integrating a thing.

Scoped keys, full control

Generate secret keys with only the scopes each integration needs — send, contacts, campaigns, verify — and rotate or revoke any key from the dashboard.

Webhooks, not polling

Subscribe an endpoint and Truspond posts signed events as they happen — delivered, read, inbound replies, verification results and payments.

The API

Everything the product does — as endpoints.

POST /v1/messages

Send messages

Send WhatsApp templates & sessions, SMS and email from one call. Set a fallback order so a message still lands if a channel fails.

POST /v1/otp/send

OTP & Verify

Send and check one-time codes across WhatsApp → SMS → email with automatic fallback. Pairs with the Verification API.

GET/POST /v1/contacts

Contacts & CRM

Create, read, update and tag contacts. Bulk import and export your list, and honour erase requests with a GDPR delete.

POST /v1/campaigns

Campaigns

Launch broadcasts to a segment, schedule sends and run A/B variants. See Campaigns.

GET/POST /v1/conversations

Inbox & replies

Read conversations, post replies and assign — drive the shared inbox from your own systems.

POST /v1/catalogue

Catalogue

Manage items, prices and stock behind your shareable shop link. See Catalogue.

GET/POST /v1/pay/requests

Payments

Raise a payment request inside a chat and get a payment.paid webhook when it settles. See Get paid on WhatsApp.

GET/POST /v1/validate/email

Email validation

Check an address for syntax, domain and live MX records before you send. See Email delivery.

GET/POST /v1/suppressions

Suppressions

Read and manage the suppression list so bounced and unsubscribed addresses stay protected automatically.

GET /v1/messages

Activity feed

List every message and its delivery events — sent, delivered, read, failed, bounced — filterable by channel, status, contact or date, and exportable.

Full request and response reference lives in the docs inside your account. Base URL https://truspond.com/v1. Every list endpoint is paginated, and a send is idempotent when you pass an idempotency_key.

Authentication

Scoped secret keys, rotated on your terms.

Create a key

In the app, open Settings → API keys and generate a secret. You will see it once — store it safely. Keys are prefixed skn_live_.

Grant scopes

Give each key only what it needs — messages:send, contacts:write, campaigns:write, suppressions:write, validations:read, stats:read. Reads and writes are separate scopes; least privilege by default.

Call the API

Pass the key as a Bearer token on every request. Rotate or revoke instantly if a key is ever exposed — no downtime for your other keys.

# every request is authenticated with your secret key Authorization: Bearer skn_live_9f2c… Content-Type: application/json # keys are scoped and rate-limited per account; 401 on a bad key, 403 on a missing scope
Webhooks

Hear the outcome the moment it happens.

Register one or more HTTPS endpoints and Truspond posts an event whenever something changes. Every payload is signed with your endpoint secret, so you can verify it came from Truspond before you act on it. No polling, no missed states.

// POST to your endpoint — headers truspond-signature: t=…,v1=… · truspond-event: delivery.delivered { "id": "evt_9f2c…", "type": "delivery.delivered", "created_at": 1755941282000, "account_id": "acc_2Rk…", "data": { "id": "msg_7Qf3…", "channel": "whatsapp", "to": "+91 98765 43210" } }

The signature is a Stripe-style HMAC — verify ${t}.${rawBody} against your endpoint secret. Deliveries retry with back-off until your endpoint returns 2xx.

Delivery events

delivery.sent, delivery.delivered, delivery.read, delivery.failed, delivery.bounced — plus message.created and submission.received.

Inbound & verification

inbound.received when a customer replies (route it to a helpdesk ticket), and verify.completed when a contact's verification succeeds.

Payments

payment.paid the instant an in-chat payment request settles — reconcile without a single poll.

Deliverability, exposed to code

Authenticate your domain, then send at scale.

Self-serve domain auth

Add DKIM, SPF and DMARC records from a guided setup and Truspond verifies them for you — so your mail is signed and lands in the inbox. Full flow on Email delivery.

Validation & suppressions

Validate addresses via API before you send, and let bounces and unsubscribes flow into a suppression list that protects your reputation automatically.

Dedicated IP

Higher-volume senders can move to a dedicated sending IP for full control of reputation, provisioned with you during onboarding. Talk to us to enable it.

Observability & privacy

See every message. Honour every request.

Message activity feed

A queryable log of every send and its delivery events — sent, delivered, read, failed, bounced — filterable by channel, status, contact or date, and exportable for your own BI.

Import, export & erase

Bulk import and export contacts, and satisfy a data-subject erase request with a single delete call — privacy by design, not an afterthought.

Predictable limits

Per-account rate limits with clear 429 back-off headers, idempotency keys on writes, and versioned, backwards-compatible responses.

Get started

From key to first message in minutes.

1 · Get your key

Sign in and create a scoped secret key under Settings.

2 · Send a test

Fire the /v1/messages call above with your own number — it lands in seconds.

3 · Wire webhooks

Point an endpoint at Truspond and start reacting to delivery, replies and payments.

Questions, answered

Developer FAQ

Do developers need a separate login?

No. Your API keys live inside your normal Truspond account. Sign in to the app, open Settings → API keys, and generate a secret key. The same account, plan and billing power both the dashboard and the API — there is no separate developer account to manage.

How do I authenticate API requests?

Every request carries your secret key as a Bearer token in the Authorization header. Keys are scoped — you grant each key only the permissions it needs (messages:send, contacts:write, campaigns:write, and so on) — and every key can be rotated or revoked from the dashboard.

Can I get delivery events without polling?

Yes. Subscribe a webhook endpoint and Truspond posts signed events as they happen — message delivered and read, inbound replies, verification results and payment confirmations. Every payload is signed so you can verify it came from Truspond.

Which channels and features are available over the API?

Send over WhatsApp, SMS and email; send and check OTPs with automatic fallback; manage contacts and import or export your CRM; run campaigns; publish a catalogue; request payments in chat; validate email addresses; manage suppressions; and read a full message activity feed. Deliverability controls like domain authentication and a dedicated IP are set up on the Email delivery side.

Build it on Truspond.

Grab a scoped API key from your account and send your first message in minutes — or talk to an engineer about webhooks, dedicated IPs and SLAs. Prefer no-code? Everything here is also in the Truspond app.